Vulnerability database

1,600 results · page 13 of 32

• Dec 6, 2024Ultimate Coming Soon & Maintenance: Unauthorized modification of dataCVE-2024-9705 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ucsm_update_template_name_lite' function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the name of the plugin's templates.

  Product

  Ultimate Coming Soon & Maintenance

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Ultimate Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 2, 2024Mins To Read: Cross-Site Request Forgery (CSRF)CVE-2024-53765 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Think201 Mins To Read mins-to-read allows Stored XSS.This issue affects Mins To Read: from n/a through <= 1.2.2.

  Product

  Mins To Read

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Mins To Read to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 26, 2024Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient inpuCVE-2024-11202 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 26, 2024Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14.CVE-2024-53278 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.8

  Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin user customizes the admin screen with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the admin screen.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordgqevu6bsiz.chicappa.jpjvn.jp

• Nov 21, 2024WIP Incoming Lite: Cross-Site Request ForgeryCVE-2024-11416 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The WIP Incoming Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the save_option() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  WIP Incoming Lite

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update WIP Incoming Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 19, 2024Disable Admin Notices individually: Cross-Site Request Forgery (CSRF)CVE-2024-52420 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Disable Admin Notices individually disable-admin-notices allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through <= 1.4.0.

  Product

  Disable Admin Notices individually

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Disable Admin Notices individually to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Minical Hotel Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51895 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pankaj9296 Minical Hotel Booking Plugin minical allows Stored XSS.This issue affects Minical Hotel Booking Plugin: from n/a through <= 1.0.2.

  Product

  Minical Hotel Booking

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Minical Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 19, 2024Admin SMS Alert: Cross-Site Request Forgery (CSRF)CVE-2024-51637 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sroyalty Admin SMS Alert admin-sms-alert allows Stored XSS.This issue affects Admin SMS Alert: from n/a through <= 1.1.0.

  Product

  Admin SMS Alert

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Admin SMS Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 14, 2024Appointmind: Cross-Site Request Forgery (CSRF)CVE-2024-51679 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gentlesource Appointmind appointmind allows Stored XSS.This issue affects Appointmind: from n/a through <= 4.0.0.

  Product

  Appointmind

  Affected

  up to 4.0.0

  What to do

  Affects up to 4.0.0. Update Appointmind to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 14, 2024Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: Missing AuthorizationCVE-2024-52383 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.1.2.

  Product

  Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 12, 2024Admin and Site Enhancements (ASE): Stored Cross-Site ScriptingCVE-2024-10790 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The Admin and Site Enhancements (ASE) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. This feature must be enabled, and for specific roles in order to be exploitable.

  Product

  Admin and Site Enhancements (ASE)

  Affected

  up to 7.5.1

  What to do

  Affects up to 7.5.1. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Nov 9, 2024Custom Admin Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51618 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Admin Menu custom-admin-menu allows Stored XSS.This issue affects Custom Admin Menu: from n/a through <= 1.0.0.

  Product

  Custom Admin Menu

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Custom Admin Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Admin Amplify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51691 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aryanduntley Admin Amplify wpr-admin-amplify allows Reflected XSS.This issue affects Admin Amplify: from n/a through <= 1.3.0.

  Product

  Admin Amplify

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Admin Amplify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024TeleAdmin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51709 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mariandz TeleAdmin teleadmin allows Reflected XSS.This issue affects TeleAdmin: from n/a through <= 1.0.0.

  Product

  TeleAdmin

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update TeleAdmin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024eewee admin custom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51780 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eewee eewee admin custom eewee-admincustom allows Reflected XSS.This issue affects eewee admin custom: from n/a through <= 1.8.2.4.

  Product

  eewee admin custom

  Affected

  up to 1.8.2.4

  What to do

  Affects up to 1.8.2.4. Update eewee admin custom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 9, 2024Administrator Z: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50524 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Quý Lê 91 Administrator Z administrator-z allows Blind SQL Injection.This issue affects Administrator Z: from n/a through < 2024.10.21.

  Product

  Administrator Z

  What to do

  Update Administrator Z to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Nov 8, 2024Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages: Reflected Cross-Site ScriptingCVE-2024-9226 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Nov 1, 2024Hummingbird: Missing AuthorizationCVE-2024-43118 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.

  Product

  Hummingbird

  Affected

  up to 3.9.1

  What to do

  Affects up to 3.9.1. Update Hummingbird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Nov 1, 2024Church Admin: Missing AuthorizationCVE-2024-37440 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.

  Product

  Church Admin

  Affected

  up to 4.4.4

  What to do

  Affects up to 4.4.4. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 31, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Insecure Direct Object ReferenceCVE-2024-9700 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the submit_quizzes() function due to missing validation on the 'entry_id' user controlled key. This makes it possible for unauthenticated attackers to modify other user's quiz submissions.

  Product

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  Affected

  up to 1.36.0

  What to do

  Affects up to 1.36.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 29, 2024Simple Custom Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49647 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carl Alberto Simple Custom Admin simple-custom-admin allows Reflected XSS.This issue affects Simple Custom Admin: from n/a through <= 1.2.

  Product

  Simple Custom Admin

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Simple Custom Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 28, 2024Church Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50438 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Reflected XSS.This issue affects Church Admin: from n/a through < 5.0.0.

  Product

  Church Admin

  Fixed in

  5.0.0

  What to do

  Update Church Admin to 5.0.0 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 26, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Unauthorized accessCVE-2024-10402 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to create new or edit existing forms, including updating the default registration role to Administrator on User Registration forms.

  Product

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  Affected

  up to 1.35.1

  What to do

  Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 24, 2024WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer: Stored Cross-Site ScriptingCVE-2024-8959 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer

  Affected

  up to 4.0.1.6

  What to do

  Affects up to 4.0.1.6. Update WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Oct 17, 2024Admin Management Xtended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49307 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Stored XSS.This issue affects Admin Management Xtended : from n/a through <= 2.4.6.

  Product

  Admin Management Xtended

  Affected

  up to 2.4.6

  What to do

  Affects up to 2.4.6. Update Admin Management Xtended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024JiangQie Free Mini Program: Unrestricted Upload of File with Dangerous TypeCVE-2024-49314 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in jiangqie JiangQie Free Mini Program jiangqie-free-mini-program allows Upload a Web Shell to a Web Server.This issue affects JiangQie Free Mini Program: from n/a through <= 2.5.2.

  Product

  JiangQie Free Mini Program

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update JiangQie Free Mini Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9352 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possible for unauthenticated attackers to create draft forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  Affected

  up to 1.35.1

  What to do

  Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9351 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for unauthenticated attackers to create draft quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  Affected

  up to 1.35.1

  What to do

  Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 16, 2024Miniorange OTP Verification with Firebase: Privilege escalationCVE-2024-9863 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled.

  Product

  Miniorange OTP Verification with Firebase

  Affected

  up to 3.6.0

  What to do

  Affects up to 3.6.0. Update Miniorange OTP Verification with Firebase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 16, 2024Miniorange OTP Verification with Firebase: Arbitrary User Password ChangeCVE-2024-9862 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.

  Product

  Miniorange OTP Verification with Firebase

  Affected

  up to 3.6.0

  What to do

  Affects up to 3.6.0. Update Miniorange OTP Verification with Firebase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 16, 2024Miniorange OTP Verification with Firebase: Authentication bypassCVE-2024-9861 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user.

  Product

  Miniorange OTP Verification with Firebase

  Affected

  up to 3.6.0

  What to do

  Affects up to 3.6.0. Update Miniorange OTP Verification with Firebase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 16, 2024ARI-Adminer: Authorization bypassCVE-2019-25215 · WordPress plugins & themes · reported by WordfenceHigh 7.3

  The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes.

  Product

  ARI-Adminer

  Affected

  up to 1.1.14

  What to do

  Affects up to 1.1.14. Update ARI-Adminer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 8, 2024Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to peCVE-2024-8983 · WordPress plugins & themes · reported by WPScanMedium 4.8

  Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Fixed in

  2.2.3

  What to do

  Update the plugin to 2.2.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 6, 2024Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47299 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Stored XSS.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.17.4.

  Product

  Coming Soon Page, Under Construction & Maintenance Mode by SeedProd

  Affected

  up to 6.17.4

  What to do

  Affects up to 6.17.4. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: PHP Object InjectionCVE-2024-9314 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'set_redirections' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

  Product

  Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

  Affected

  up to 1.0.228

  What to do

  Affects up to 1.0.228. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 5, 2024Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized modification and loss of dataCVE-2024-9161 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.

  Product

  Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

  Affected

  up to 1.0.228

  What to do

  Affects up to 1.0.228. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 24, 2024REST API TO MiniProgram: Privilege escalationCVE-2024-8485 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's account, including administrators.

  Product

  REST API TO MiniProgram

  Affected

  up to 4.7.1

  What to do

  Affects up to 4.7.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 24, 2024REST API TO MiniProgram: SQL InjectionCVE-2024-8484 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  REST API TO MiniProgram

  Affected

  up to 4.7.1

  What to do

  Affects up to 4.7.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 17, 2024Posts reminder: Does not have CSRF check in placeCVE-2024-8093 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

  Product

  Posts reminder

  Affected

  up to 0.20

  What to do

  Affects up to 0.20. Update Posts reminder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 13, 2024Favicon Generator (CLOSED): Does not have CSRF and path validation in the output_sub_admin_page_0() functionCVE-2024-7864 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server

  Product

  Favicon Generator (CLOSED)

  Fixed in

  2.1

  What to do

  Update Favicon Generator (CLOSED) to 2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Sep 12, 2024Music Request Manager: Does not sanitise and escape incoming music requestsCVE-2024-6019 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators

  Product

  Music Request Manager

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 9, 2024Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1.CVE-2024-45625 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1

  Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.

  Fixed in

  1.34.1

  What to do

  Update the plugin to 1.34.1 or newer.

  Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org

• Sep 2, 2024Flaming Forms: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-7692 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

  Product

  Flaming Forms

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Sep 2, 2024Flaming Forms: Does not sanitise and escape some parametersCVE-2024-7691 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators.

  Product

  Flaming Forms

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 30, 2024Tutor LMS Pro: Unauthorized administrative actions executionCVE-2024-5784 · WordPress plugins & themes · reported by WordfenceHigh 7.1

  The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and tutor_gc_class_action in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with the subscriber-level access and above, to preform an administrative actions on the site, like comments, posts or users deletion, viewing notifications, etc.

  Product

  Tutor LMS Pro

  Affected

  up to 2.7.2

  What to do

  Affects up to 2.7.2. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordtutorlms.comwordfence.com

• Aug 29, 2024Maintenance & Coming Soon Redirect Animation: Authentication Bypass by SpoofingCVE-2024-43944 · WordPress plugins & themes · reported by PatchstackLow 3.7

  Authentication Bypass by Spoofing vulnerability in ilyasine Maintenance & Coming Soon Redirect Animation maintenance-coming-soon-redirect-animation allows Identity Spoofing.This issue affects Maintenance & Coming Soon Redirect Animation: from n/a through <= 2.3.3.

  Product

  Maintenance & Coming Soon Redirect Animation

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Maintenance & Coming Soon Redirect Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 26, 2024Hummingbird: Cross-Site Request Forgery (CSRF)CVE-2024-43117 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.

  Product

  Hummingbird

  Affected

  up to 3.9.1

  What to do

  Affects up to 3.9.1. Update Hummingbird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2024Coming Soon: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38756 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Weblizar Coming Soon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming Soon: from n/a through 1.6.3.

  Product

  Coming Soon

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 2, 2024Forminator: Sensitive Information ExposureCVE-2024-7389 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin's HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration.

  Product

  Forminator

  Affected

  up to 1.29.1

  What to do

  Affects up to 1.29.1. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddevelopers.hubspot.comdevelopers.hubspot.com

• Jul 31, 2024it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions.CVE-2024-6695 · WordPress plugins & themes · reported by WPScanCritical 9.8

  it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.

  Fixed in

  3.11.9

  What to do

  Update the plugin to 3.11.9 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.