Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,019 results · page 13 of 21

Dec 31, 2024WPLMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56042 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
Product
WPLMS
Fixed in
1.9.9.5.3
What to do
Update WPLMS to 1.9.9.5.3 or newer.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024VibeBP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56041 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.5.1.
Product
VibeBP
What to do
Update VibeBP to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024VibeBP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56039 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.7.7.
Product
VibeBP
What to do
Update VibeBP to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Userpro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56212 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9.
Product
Userpro
Affected
up to 5.1.9
What to do
Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024WPLMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56053 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
Product
WPLMS
Fixed in
1.9.9.5.3
What to do
Update WPLMS to 1.9.9.5.3 or newer.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024WPLMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56047 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
Product
WPLMS
Fixed in
1.9.9.5.3
What to do
Update WPLMS to 1.9.9.5.3 or newer.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024YDS Support Ticket System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55985 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ydesignservices YDS Support Ticket System yds-support-ticket-system allows SQL Injection.This issue affects YDS Support Ticket System: from n/a through <= 1.0.
Product
YDS Support Ticket System
Affected
up to 1.0
What to do
Affects up to 1.0. Update YDS Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Saksh Escrow System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55984 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susheelhbti Saksh Escrow System saksh-escrow-system allows SQL Injection.This issue affects Saksh Escrow System: from n/a through <= 2.4.
Product
Saksh Escrow System
Affected
up to 2.4
What to do
Affects up to 2.4. Update Saksh Escrow System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024PowerFormBuilder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55983 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PowerFormBuilder PowerFormBuilder power-forms-builder allows SQL Injection.This issue affects PowerFormBuilder: from n/a through <= 1.0.6.
Product
PowerFormBuilder
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update PowerFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Dr Affiliate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55975 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rohit Urane Dr Affiliate dr-affiliate allows SQL Injection.This issue affects Dr Affiliate: from n/a through <= 1.2.3.
Product
Dr Affiliate
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Dr Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024SeedProd Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54284 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10.
Product
SeedProd Pro
Affected
up to 6.18.10
What to do
Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024SeedProd Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54283 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10.
Product
SeedProd Pro
Affected
up to 6.18.10
What to do
Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024WPBookit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54280 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.
Product
WPBookit
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Mollie for Contact Form 7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55990 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tsjippy Mollie for Contact Form 7 cf7-mollie allows Blind SQL Injection.This issue affects Mollie for Contact Form 7: from n/a through <= 5.0.0.
Product
Mollie for Contact Form 7
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Mollie for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024WP Simple Pay Lite Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55989 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kyle M Brown WP Simple Pay Lite Manager stripe-manager allows SQL Injection.This issue affects WP Simple Pay Lite Manager: from n/a through <= 1.4.
Product
WP Simple Pay Lite Manager
Affected
up to 1.4
What to do
Affects up to 1.4. Update WP Simple Pay Lite Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Navayan CSV Export: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55988 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export navayan-csv-export allows Blind SQL Injection.This issue affects Navayan CSV Export: from n/a through <= 1.0.9.
Product
Navayan CSV Export
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Navayan CSV Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Advanced What should we write next about: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55987 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows SQL Injection.This issue affects Advanced What should we write next about: from n/a through <= 1.0.3.
Product
Advanced What should we write next about
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Advanced What should we write next about to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Service: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55986 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tiny13 Service service allows Blind SQL Injection.This issue affects Service: from n/a through <= 1.0.4.
Product
Service
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Share Buttons – Social Media: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55982 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.
Product
Share Buttons – Social Media
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Share Buttons – Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Nabz Image Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55981 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.
Product
Nabz Image Gallery
Affected
up to 1.00
What to do
Affects up to 1.00. Update Nabz Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55980 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.
Product
Wr Age Verification
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55979 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.
Product
Wr Age Verification
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Code Generator Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55978 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WalletStation Code Generator Pro code-generator-pro allows SQL Injection.This issue affects Code Generator Pro: from n/a through <= 1.2.
Product
Code Generator Pro
Affected
up to 1.2
What to do
Affects up to 1.2. Update Code Generator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024LaunchPage.app Importer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55977 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BinaryCarpenter LaunchPage.app Importer launchpage-app-importer allows SQL Injection.This issue affects LaunchPage.app Importer: from n/a through <= 1.1.
Product
LaunchPage.app Importer
Affected
up to 1.1
What to do
Affects up to 1.1. Update LaunchPage.app Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Critical Site Intel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55976 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mikeleembruggen Critical Site Intel critical-site-intel-stats allows SQL Injection.This issue affects Critical Site Intel: from n/a through <= 1.0.
Product
Critical Site Intel
Affected
up to 1.0
What to do
Affects up to 1.0. Update Critical Site Intel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Mimoos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55974 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martí Batlles Martinez Mimoos devoluciones-packback allows SQL Injection.This issue affects Mimoos: from n/a through <= 1.2.
Product
Mimoos
Affected
up to 1.2
What to do
Affects up to 1.2. Update Mimoos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024TSB Occasion Editor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55973 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rnystrom TSB Occasion Editor tsb-occasion-editor allows SQL Injection.This issue affects TSB Occasion Editor: from n/a through <= 1.2.1.
Product
TSB Occasion Editor
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update TSB Occasion Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024eTemplates: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55972 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.
Product
eTemplates
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update eTemplates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Instant Appointment: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54361 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tenteeglobal Instant Appointment instant-appointment allows SQL Injection.This issue affects Instant Appointment: from n/a through <= 1.2.
Product
Instant Appointment
Affected
up to 1.2
What to do
Affects up to 1.2. Update Instant Appointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Hive Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54304 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hive Support Hive Support hive-support allows SQL Injection.This issue affects Hive Support: from n/a through <= 1.1.2.
Product
Hive Support
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Appsplate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54292 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsplate Appsplate appsplate allows SQL Injection.This issue affects Appsplate: from n/a through <= 2.1.3.
Product
Appsplate
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Appsplate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024TAX SERVICE Electronic HDM: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54261 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM virtual-hdm-for-taxservice-am allows SQL Injection.This issue affects TAX SERVICE Electronic HDM: from n/a through <= 1.2.2.
Product
TAX SERVICE Electronic HDM
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update TAX SERVICE Electronic HDM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni CRM Lead: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54258 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows SQL Injection.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
Product
Ni CRM Lead
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Limit Login Attempts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54234 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.
Product
Limit Login Attempts
Affected
up to 5.5
What to do
Affects up to 5.5. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Revy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54215 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy.This issue affects Revy: from n/a through <= 1.18.
Product
Revy
Affected
up to 1.18
What to do
Affects up to 1.18. Update Revy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024Product Labels For Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53817 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Product Labels For Woocommerce aco-product-labels-for-woocommerce allows Blind SQL Injection.This issue affects Product Labels For Woocommerce: from n/a through <= 1.5.8.
Product
Product Labels For Woocommerce
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Product Labels For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024Pinpoint Booking System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53815 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Blind SQL Injection.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.1.
Product
Pinpoint Booking System
Affected
up to 2.9.9.5.1
What to do
Affects up to 2.9.9.5.1. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024NEX-Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53808 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows SQL Injection.This issue affects NEX-Forms: from n/a through <= 8.7.8.
Product
NEX-Forms
Affected
up to 8.7.8
What to do
Affects up to 8.7.8. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024WP Mailster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53807 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brandtoss WP Mailster wp-mailster allows Blind SQL Injection.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
Product
WP Mailster
Affected
up to 1.8.16.0
What to do
Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024WordPress Auction: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51615 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows SQL Injection.This issue affects WordPress Auction Plugin: from n/a through <= 3.7.
Product
WordPress Auction
Affected
up to 3.7
What to do
Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 4, 2024FAT Services Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54221 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking.This issue affects FAT Services Booking: from n/a through <= 5.6.
Product
FAT Services Booking
Affected
up to 5.6
What to do
Affects up to 5.6. Update FAT Services Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 2, 2024Watu Quiz: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53792 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through <= 3.4.1.2.
Product
Watu Quiz
Affected
up to 3.4.1.2
What to do
Affects up to 3.4.1.2. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 30, 2024Ni WooCommerce Cost Of Goods: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53783 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.
Product
Ni WooCommerce Cost Of Goods
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Ni WooCommerce Cost Of Goods to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024Distance Based Shipping Calculator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52495 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows SQL Injection.This issue affects Distance Based Shipping Calculator: from n/a through <= 2.0.23.
Product
Distance Based Shipping Calculator
Affected
up to 2.0.23
What to do
Affects up to 2.0.23. Update Distance Based Shipping Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024Express Payments Module: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52474 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Сервис “Экспресс Платежи” Express Payments Module express-pay allows Blind SQL Injection.This issue affects Express Payments Module: from n/a through <= 1.1.8.
Product
Express Payments Module
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Express Payments Module to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024Post SMTP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52436 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal Post SMTP post-smtp allows Blind SQL Injection.This issue affects Post SMTP: from n/a through <= 2.9.9.
Product
Post SMTP
Affected
up to 2.9.9
What to do
Affects up to 2.9.9. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024WPDM – Premium Packages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52435 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.5.
Product
WPDM – Premium Packages
Affected
up to 6.0.5
What to do
Affects up to 6.0.5. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024WordPress Video Robot - The Ultimate Video Importer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-52431 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressaholic WordPress Video Robot - The Ultimate Video Importer allows SQL Injection.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0.
Product
WordPress Video Robot - The Ultimate Video Importer
Affected
up to 1.20.0
What to do
Affects up to 1.20.0. Update WordPress Video Robot - The Ultimate Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024Gboy Custom Google Map: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51882 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopalkumar315 Gboy Custom Google Map gboy-custom-google-map allows Blind SQL Injection.This issue affects Gboy Custom Google Map: from n/a through <= 1.2.
Product
Gboy Custom Google Map
Affected
up to 1.2
What to do
Affects up to 1.2. Update Gboy Custom Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024Share Buttons – Social Media: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51845 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.
Product
Share Buttons – Social Media
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Share Buttons – Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.