Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,094 results · page 13 of 22

Dec 25, 2024Avada (Fusion) Builder: Information ExposureCVE-2024-12335 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post() function and the 'fusion_blog' shortcode and due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Avada (Fusion) Builder
Affected
up to 3.11.12
What to do
Affects up to 3.11.12. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avada.com wordfence.com
Dec 24, 2024Content No Cache: prevent specific content from being cached: Information ExposureCVE-2024-12103 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Content No Cache: prevent specific content from being cached plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.1.2 via the eos_dyn_get_content action due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Product
Content No Cache: prevent specific content from being cached
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update Content No Cache: prevent specific content from being cached to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024Full Screen Menu for Elementor: Information ExposureCVE-2024-10797 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen Menu Elementor Widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from private or draft posts created with Elementor that they should not have access to.
Product
Full Screen Menu for Elementor
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Full Screen Menu for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 20, 2024Page Restriction WordPress (WP) – Protect WP Pages/Post: Sensitive Information ExposureCVE-2024-11297 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Page Restriction WordPress (WP) – Protect WP Pages/Post
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Page Restriction WordPress (WP) – Protect WP Pages/Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 19, 2024Button Block – Get fully customizable & multi-functional buttons: Sensitive Information ExposureCVE-2024-12560 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.
Product
Button Block – Get fully customizable & multi-functional buttons
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Button Block – Get fully customizable & multi-functional buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2024WP Project Manager: Sensitive Information ExposureCVE-2024-10548 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task List ('/wp-json/pm/v2/projects/1/task-lists') REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the hashed passwords of project owners (e.g. adminstrators).
Product
WP Project Manager
Affected
up to 2.6.15
What to do
Affects up to 2.6.15. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Sensitive Information ExposureCVE-2024-11291 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
Product
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.13.4
What to do
Affects up to 2.13.4. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2024Animation Addons for Elementor: Sensitive Information ExposureCVE-2024-12340 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
Product
Animation Addons for Elementor
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Animation Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2024Simple Page Access Restriction: Sensitive Information ExposureCVE-2024-11295 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.29 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
Product
Simple Page Access Restriction
Affected
up to 1.0.29
What to do
Affects up to 1.0.29. Update Simple Page Access Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024Accept Authorize.NET Payments Using Contact Form 7: Information ExposureCVE-2024-12250 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configuration data which can be used to aid in other attacks.
Product
Accept Authorize.NET Payments Using Contact Form 7
Affected
up to 2.2
What to do
Affects up to 2.2. Update Accept Authorize.NET Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024Events Addon for Elementor: Information ExposureCVE-2024-12061 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naevents_elementor_template shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Events Addon for Elementor
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Events Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024ElementsReady Addons for Elementor: Sensitive Information ExposureCVE-2024-10356 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.8 in inc/Widgets/accordion/output/content.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
ElementsReady Addons for Elementor
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024PPWP – Password Protect Pages: Sensitive Information ExposureCVE-2024-11280 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
PPWP – Password Protect Pages
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update PPWP – Password Protect Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Sensitive Information ExposureCVE-2024-8326 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 241114 via the 'sc_get_details' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including user data and database configuration information, which can lead to reading, updating, or dropping database tables. The vulnerability was partially patched in version 241114.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 241114
What to do
Affects up to 241114. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024Memberful: Sensitive Information ExposureCVE-2024-11294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Memberful plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.73.9 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as site members.
Product
Memberful
Affected
up to 1.73.9
What to do
Affects up to 1.73.9. Update Memberful to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2024WP-NERD Toolkit: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-54279 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tobias Keller WP-NERD Toolkit wp-nerd-toolkit.This issue affects WP-NERD Toolkit: from n/a through <= 1.1.
Product
WP-NERD Toolkit
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP-NERD Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 14, 2024Shortcodes for Elementor: Information ExposureCVE-2024-10690 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the 'SHORTCODE_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created with Elementor that they should not have access to.
Product
Shortcodes for Elementor
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Shortcodes for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Tickera – WordPress Event Ticketing: Information ExposureCVE-2024-12578 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the 'tickera_tickets_info' endpoint. This makes it possible for unauthenticated attackers to extract sensitive data from bookings like full names, email addresses, check-in/out timestamps and more.
Product
Tickera – WordPress Event Ticketing
Affected
up to 3.5.4.8
What to do
Affects up to 3.5.4.8. Update Tickera – WordPress Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Greenshift – animation and page builder blocks: Information ExposureCVE-2024-11181 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wp_reusable_render' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Greenshift – animation and page builder blocks
Affected
up to 9.9.9.3
What to do
Affects up to 9.9.9.3. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Accept Stripe Payments Using Contact Form 7: Information ExposureCVE-2024-12255 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf7sa-info.php file that returns phpinfo() data. This makes it possible for unauthenticated attackers to extract configuration information that can be leveraged in another attack.
Product
Accept Stripe Payments Using Contact Form 7
Affected
up to 2.5
What to do
Affects up to 2.5. Update Accept Stripe Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024ElementInvader Addons for Elementor: Sensitive Information ExposureCVE-2024-12059 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the eli_option_value shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract arbitrary options from the wp_options table.
Product
ElementInvader Addons for Elementor
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024Restrict – membership, site, content and user access restrictions for: Sensitive Information ExposureCVE-2024-11351 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.8 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Restrict – membership, site, content and user access restrictions for
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Restrict – membership, site, content and user access restrictions for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024Last Viewed Posts by WPBeginner: Sensitive Information ExposureCVE-2024-12294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the 'get_legacy_cookies' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and permalinks of private, password-protected, pending, and draft posts.
Product
Last Viewed Posts by WPBeginner
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Last Viewed Posts by WPBeginner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024Members – Membership & User Role Editor: Sensitive Information ExposureCVE-2024-11008 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Members – Membership & User Role Editor
Affected
up to 3.2.10
What to do
Affects up to 3.2.10. Update Members – Membership & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 10, 2024LearnPress – WordPress LMS: Sensitive Information ExposureCVE-2024-11868 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. This makes it possible for unauthenticated attackers to extract potentially sensitive paid course material.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.7.3
What to do
Affects up to 4.2.7.3. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record abrahack.com plugins.trac.wordpress.org
Dec 10, 2024Simple Restrict: Sensitive Information ExposureCVE-2024-11106 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Simple Restrict
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Simple Restrict to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2024Analytify: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-53814 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a through <= 5.4.3.
Product
Analytify
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024WP Private Content Plus: Sensitive Information ExposureCVE-2024-11292 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
WP Private Content Plus
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update WP Private Content Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 6, 2024PowerPack Elementor Addons (Free Widgets, Extensions and Templates): Information ExposureCVE-2024-10692 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 via the Content Reveal widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update PowerPack Elementor Addons (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024XLTab – Accordions and Tabs for Elementor Page Builder: Information ExposureCVE-2024-10689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The XLTab – Accordions and Tabs for Elementor Page Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4 via the 'XLTAB_INSERT_TPL' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
XLTab – Accordions and Tabs for Elementor Page Builder
Affected
up to 1.4
What to do
Affects up to 1.4. Update XLTab – Accordions and Tabs for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2024AnyWhere Elementor: Information ExposureCVE-2024-10777 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
AnyWhere Elementor
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2024Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins: Sensitive Information ExposureCVE-2024-10937 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.58 via the wp_ajax_nopriv_related_post_ajax_get_post_ids AJAX action. This makes it possible for unauthenticated attackers to extract sensitive data including titles of posts in draft status.
Product
Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins
Affected
up to 2.0.58
What to do
Affects up to 2.0.58. Update Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 4, 2024LA-Studio Element Kit for Elementor: Information ExposureCVE-2024-10787 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created by Elementor that they should not have access to.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 3, 2024Dollie Hub – Build Your Own WordPress Cloud Platform: Information ExposureCVE-2024-12099 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Dollie Hub – Build Your Own WordPress Cloud Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.2.0 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Dollie Hub – Build Your Own WordPress Cloud Platform
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Dollie Hub – Build Your Own WordPress Cloud Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 3, 2024Charity Addon for Elementor: Information ExposureCVE-2024-12062 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.3 via the 'nacharity_elementor_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Charity Addon for Elementor
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Charity Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 30, 2024Content Audit Exporter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-53768 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ideinteractive Content Audit Exporter content-audit-exporter allows Retrieve Embedded Sensitive Data.This issue affects Content Audit Exporter: from n/a through <= 1.1.
Product
Content Audit Exporter
Affected
up to 1.1
What to do
Affects up to 1.1. Update Content Audit Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024Royal Elementor Addons and Templates: Information ExposureCVE-2024-10798 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1003
What to do
Affects up to 1.7.1003. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 28, 2024Restaurant & Cafe Addon for Elementor: Information ExposureCVE-2024-10780 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.9 via the 'narestaurant_elementor_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Restaurant & Cafe Addon for Elementor
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 28, 2024Primary Addon for Elementor: Information ExposureCVE-2024-10670 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via the [prim_elementor_template] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created with Elementor that they should not have access to.
Product
Primary Addon for Elementor
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 27, 2024ProfilePress: Sensitive Information ExposureCVE-2024-11083 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
ProfilePress
Affected
up to 4.15.18
What to do
Affects up to 4.15.18. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 26, 2024Jeg Elementor Kit: Sensitive Information ExposureCVE-2024-8899 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the render_content function in class/elements/views/class-tabs-view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
Jeg Elementor Kit
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 23, 2024Increase Maximum Upload File Size | Increase Execution Time: Full Path DisclosureCVE-2024-11265 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.3. This is due to returning image upload error messages with full path information. This makes it possible for authenticated attackers, with author-level permissions and above, to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Increase Maximum Upload File Size | Increase Execution Time
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Increase Maximum Upload File Size | Increase Execution Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024Enter Addons – Ultimate Template Builder for Elementor: Information ExposureCVE-2024-10868 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.9 via the Advanced Tabs widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Enter Addons – Ultimate Template Builder for Elementor
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Enter Addons – Ultimate Template Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 22, 2024Product Table for WooCommerce by CodeAstrology (wooproducttable.com): Sensitive Information ExposureCVE-2024-10813 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1 via the var_dump_table parameter. This makes it possible for unauthenticated attackers var data.
Product
Product Table for WooCommerce by CodeAstrology (wooproducttable.com)
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Product Table for WooCommerce by CodeAstrology (wooproducttable.com) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024Easy Twitter Feed – Twitter feeds plugin for WP: Information ExposureCVE-2024-10666 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the [etf] shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Easy Twitter Feed – Twitter feeds plugin for WP
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Easy Twitter Feed – Twitter feeds plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 21, 2024Anonymous Restricted Content: Sensitive Information ExposureCVE-2024-11089 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to logged-in users.
Product
Anonymous Restricted Content
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Anonymous Restricted Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Simple Membership: Sensitive Information ExposureCVE-2024-11088 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Simple Membership
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Sky Addons for Elementor: Sensitive Information ExposureCVE-2024-9542 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the render function in modules/content-switcher/widgets/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
Product
Sky Addons for Elementor
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Sky Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024If-So Dynamic Content Personalization: Information ExposureCVE-2024-10796 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Product
If-So Dynamic Content Personalization
Affected
up to 1.9.2.1
What to do
Affects up to 1.9.2.1. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Theme Builder For Elementor: Information ExposureCVE-2024-10782 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Theme Builder For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Theme Builder For Elementor
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Theme Builder For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.