Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,023 results · page 13 of 21

Oct 16, 2024Google Language Translator: Reflected Cross-Site ScriptingCVE-2021-4452 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Specifically affects users with older browsers that lack proper URL encoding support.
Product
Google Language Translator
Affected
up to 6.0.9
What to do
Affects up to 6.0.9. Update Google Language Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons: Reflected Cross-Site ScriptingCVE-2024-8541 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site administrator into performing an action such as clicking on a link. Please note that this is only exploitable when the 'Leave a Review' notice is present, which occurs after 100 orders are made and disappears after a user dismisses the notice.
Product
Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons
Affected
up to 2.6.5
What to do
Affects up to 2.6.5. Update Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2024Category Icon: Stored Cross-Site ScriptingCVE-2024-8915 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Category Icon
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 6, 2024Automatically Hierarchic Categories in Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in Menu: from n/a through <= 2.0.5.
Product
Automatically Hierarchic Categories in Menu
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Logo Carousel – Clients logo carousel for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel – Clients logo carousel for WP: from n/a through <= 1.2.
Product
Logo Carousel – Clients logo carousel for WP
Affected
up to 1.2
What to do
Affects up to 1.2. Update Logo Carousel – Clients logo carousel for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 4, 2024Login Logout Shortcode: Stored Cross-Site ScriptingCVE-2024-9421 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Login Logout Shortcode
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Login Logout Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 1, 2024Relogo: Stored Cross-Site ScriptingCVE-2024-9269 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Relogo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Relogo
Affected
up to 0.4.2
What to do
Affects up to 0.4.2. Update Relogo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 25, 2024Prisna GWT – Google Website Translator: PHP Object InjectionCVE-2024-8514 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.11 via deserialization of untrusted input from the 'prisna_import' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Prisna GWT – Google Website Translator
Affected
up to 1.4.11
What to do
Affects up to 1.4.11. Update Prisna GWT – Google Website Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2024Simple Calendar – Google Calendar: Reflected Cross-Site ScriptingCVE-2024-8549 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Simple Calendar – Google Calendar
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update Simple Calendar – Google Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2024The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins.CVE-2024-6590 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 3.8.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit post status, edit Google sheet integrations, and create Google sheet integrations.
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2024WP Category Dropdown: Stored Cross-Site ScriptingCVE-2024-8103 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Category Dropdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Category Dropdown
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP Category Dropdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2024Arni Cinco WPCargo Track & Trace wpcargo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-44004 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.
Product
Arni Cinco WPCargo Track & Trace wpcargo
Fixed in
8.0.4
What to do
Update Arni Cinco WPCargo Track & Trace wpcargo to 8.0.4 or newer.
Full record and what to do →NVD record patchstack.com
Sep 17, 2024Logo Manager For Enamad: Does not sanitise and escape in its widgets settingsCVE-2024-5170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Logo Manager For Enamad WordPress plugin through 0.7.1 does not sanitise and escape in its widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Logo Manager For Enamad
Affected
up to 0.7.1
What to do
Affects up to 0.7.1. Update Logo Manager For Enamad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2024Logo Slider: Does not sanitise and escape some of its settingsCVE-2024-7716 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Logo Slider
Fixed in
3.6.9
What to do
Update Logo Slider to 3.6.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 27, 2024Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More: Cross-Site Request ForgeryCVE-2024-8200 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'update_api_key' function. This makes it possible for unauthenticated attackers to update an API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More: Unauthorized modification of dataCVE-2024-8199 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_api_key' function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update API Key options.
Product
Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid: Stored Cross-Site ScriptingCVE-2024-8046 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 23, 2024WooCommerce Google Feed Manager: Unauthorized loss of dataCVE-2024-7258 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WooCommerce Google Feed Manager
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update WooCommerce Google Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2024Sheet to Table Live Sync for Google Sheet: Stored Cross-Site ScriptingCVE-2024-6532 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sheet to Table Live Sync for Google Sheet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STWT_Sheet_Table shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sheet to Table Live Sync for Google Sheet
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Sheet to Table Live Sync for Google Sheet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2024Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget: Does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the WCVE-2024-6158 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget
Fixed in
4.9.17
What to do
Update Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget to 4.9.17 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2024WP GoToWebinar: Cross-Site Request Forgery (CSRF)CVE-2024-38776 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson WP GoToWebinar allows Cross-Site Scripting (XSS).This issue affects WP GoToWebinar: from n/a through 15.7.
Product
WP GoToWebinar
Affected
up to 15.7
What to do
Affects up to 15.7. Update WP GoToWebinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024MakeStories (for Google Web Stories): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MakeStories Team MakeStories (for Google Web Stories) allows Path Traversal, Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through 3.0.3.
Product
MakeStories (for Google Web Stories)
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update MakeStories (for Google Web Stories) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 21, 2024Login Logo Editor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37523 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AMP-MODE Login Logo Editor allows Stored XSS.This issue affects Login Logo Editor: from n/a through 1.3.3.
Product
Login Logo Editor
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Login Logo Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024Goftino: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali Rahimi Goftino allows Stored XSS.This issue affects Goftino: from n/a through 1.6.
Product
Goftino
Affected
up to 1.6
What to do
Affects up to 1.6. Update Goftino to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024WP GoToWebinar: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38671 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Martin Gibson WP GoToWebinar allows Stored XSS.This issue affects WP GoToWebinar: from n/a through 15.7.
Product
WP GoToWebinar
Affected
up to 15.7
What to do
Affects up to 15.7. Update WP GoToWebinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024Mercado Pago payments for WooCommerce: Path TraversalCVE-2024-3934 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. The arbitrary file download was patched in 7.5.1, while the missing authorization was corrected in version 7.6.2.
Product
Mercado Pago payments for WooCommerce
Affected
7.3.0 to 7.5.1
What to do
Affects 7.3.0 to 7.5.1. Update Mercado Pago payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2024Events Calendar for Google: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38716 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blue Plugins Events Calendar for Google allows PHP Local File Inclusion.This issue affects Events Calendar for Google: from n/a through 2.1.0.
Product
Events Calendar for Google
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Events Calendar for Google to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Cliengo – Chatbot: Unauthorized modification of dataCVE-2024-5993 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_session' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the session token of the chatbot.
Product
Cliengo – Chatbot
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Cliengo – Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Cliengo – Chatbot: Unauthorized modification of dataCVE-2024-5992 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' and 'update_chatbot_position' functions in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to change chatbot settings, which can lead to unavailability or other changes to the chatbot.
Product
Cliengo – Chatbot
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Cliengo – Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Cliengo – Chatbot: Cross-Site Request Forgery (CSRF)CVE-2024-37923 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in cliengo Cliengo – Chatbot cliengo allows Cross Site Request Forgery.This issue affects Cliengo – Chatbot: from n/a through <= 3.0.4.
Product
Cliengo – Chatbot
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Cliengo – Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Blog, Posts and Category Filter for Elementor: Stored Cross-Site ScriptingCVE-2024-4667 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blog, Posts and Category Filter for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post and Category Filter widget in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied 'post_types' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Blog, Posts and Category Filter for Elementor
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Blog, Posts and Category Filter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 2, 2024Easy Google Maps: Stored Cross-Site ScriptingCVE-2024-5219 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 1.11.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Google Maps
Affected
up to 1.11.15
What to do
Affects up to 1.11.15. Update Easy Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 29, 2024WordPress Plugin for Google Maps – WP MAPS: SQL InjectionCVE-2024-2386 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WordPress Plugin for Google Maps – WP MAPS
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update WordPress Plugin for Google Maps – WP MAPS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 29, 2024Goya: Reflected Cross-Site ScriptingCVE-2023-4017 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Goya
Affected
up to 1.0.8.7
What to do
Affects up to 1.0.8.7. Update Goya to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record goya.everthemes.com themeforest.net
Jun 28, 2024The Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) plugin for WordCVE-2024-5662 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the Social Count (Static) widget in all versions up to, and including, 3.11.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.11.7
What to do
Affects up to 3.11.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 28, 2024Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce: Reflected Cross-Site ScriptingCVE-2024-6288 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tiktok_user_id’ parameter in all versions up to, and including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Affected
up to 7.1.0
What to do
Affects up to 7.1.0. Update Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 25, 2024Logo Manager For Enamad: Does not have CSRF check in some placesCVE-2024-4757 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Product
Logo Manager For Enamad
Affected
up to 0.7.0
What to do
Affects up to 0.7.0. Update Logo Manager For Enamad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024Google CSE: Does not sanitise and escape some of its settingsCVE-2024-4755 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Google CSE
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Google CSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2024WP Go Maps (formerly WP Google Maps): Stored Cross-Site ScriptingCVE-2024-5994 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions up to, and including, 9.0.38. This makes it possible for authenticated attackers that have been explicitly granted permissions by an administrator, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 9.0.39 adds a caution to make administrators aware of the possibility for abuse if permissions are granted to lower-level users.
Product
WP Go Maps (formerly WP Google Maps)
Affected
up to 9.0.38
What to do
Affects up to 9.0.38. Update WP Go Maps (formerly WP Google Maps) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2024The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerableCVE-2024-1565 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the PDF Widget URL in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2024Integrate Google Drive: Missing AuthorizationCVE-2023-52177 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.3.
Product
Integrate Google Drive
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Integrate Google Drive: Missing AuthorizationCVE-2024-32813 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.9.
Product
Integrate Google Drive
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WP GoToWebinar: Missing AuthorizationCVE-2024-32804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Martin Gibson WP GoToWebinar.This issue affects WP GoToWebinar: from n/a through 14.46.
Product
WP GoToWebinar
Affected
up to 14.46
What to do
Affects up to 14.46. Update WP GoToWebinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024CF7 Google Sheets Connector: Unauthorized modification of dataCVE-2024-5654 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration settings, including WP_DEBUG, WP_DEBUG_LOG, SCRIPT_DEBUG, and SAVEQUERIES.
Product
CF7 Google Sheets Connector
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update CF7 Google Sheets Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024Logo Slider: Does not validate and escape some of its Slider Settings before outputting them back in attributesCVE-2024-3288 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Logo Slider
Fixed in
4.0.0
What to do
Update Logo Slider to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-5571 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's EmbedPress PDF widget in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024Integrate Google Drive: Broken AuthenticationCVE-2024-35670 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Broken Authentication vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.93.
Product
Integrate Google Drive
Affected
up to 1.3.93
What to do
Affects up to 1.3.93. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 30, 2024List categories: Stored Cross-Site ScriptingCVE-2024-4356 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The List categories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'categories' shortcode in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
List categories
Affected
up to 0.4
What to do
Affects up to 0.4. Update List categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 29, 2024Login Logout Register Menu: Stored Cross-Site ScriptingCVE-2024-3726 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'llrmloginlogout' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Login Logout Register Menu
Affected
up to 2.0
What to do
Affects up to 2.0. Update Login Logout Register Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
May 25, 2024Reviews and Rating – Google Reviews: Stored Cross-Site ScriptingCVE-2024-5218 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Reviews and Rating – Google Reviews
Affected
up to 5.2
What to do
Affects up to 5.2. Update Reviews and Rating – Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.