Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

9,124 results · page 134 of 183

May 18, 2024Happy Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-5088 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Happy Addons for Elementor
Affected
up to 3.10.8
What to do
Affects up to 3.10.8. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 18, 2024Piotnet Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-4432 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.4.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Piotnet Addons For Elementor
Affected
up to 2.4.26
What to do
Affects up to 2.4.26. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 18, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-4709 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subject’ parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.16
What to do
Affects up to 5.1.16. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 18, 2024Testimonial Carousel For Elementor: Stored Cross-Site ScriptingCVE-2024-4698 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slide_button_hover_animation' parameters in versions up to, and including, 10.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35713 is likely a duplicate of this issue.
Product
Testimonial Carousel For Elementor
Affected
up to 10.1.1
What to do
Affects up to 10.1.1. Update Testimonial Carousel For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 18, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-2772 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Fluent Forms settings, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can be chained with CVE-2024-2771 for a low-privileged user to inject malicious web scripts.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.13
What to do
Affects up to 5.1.13. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 18, 2024WordPress Automatic: Stored Cross-Site ScriptingCVE-2024-4849 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Automatic Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 3.94.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Automatic
Affected
up to 3.94.0
What to do
Affects up to 3.94.0. Update WordPress Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
May 18, 2024Salient Shortcodes: Stored Cross-Site ScriptingCVE-2024-3811 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Salient Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'icon' shortcode in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Salient Shortcodes
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Salient Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 18, 2024Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2024-4891 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 4.5.12
What to do
Affects up to 4.5.12. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 18, 2024DethemeKit For Elementor: Stored Cross-Site ScriptingCVE-2024-4374 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DethemeKit For Elementor
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 18, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-3714 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 17, 2024Happy Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-4865 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Happy Addons for Elementor
Affected
up to 3.10.8
What to do
Affects up to 3.10.8. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2024BuddyForms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-32830 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeKraft BuddyForms allows Server Side Request Forgery, Relative Path Traversal.This issue affects BuddyForms: from n/a through 2.8.8.
Product
BuddyForms
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update BuddyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Royal Elementor Addons: Authentication Bypass by SpoofingCVE-2024-32786 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from n/a through 1.3.93.
Product
Royal Elementor Addons
Affected
up to 1.3.93
What to do
Affects up to 1.3.93. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() functionCVE-2024-4789 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected
up to 3.1.72
What to do
Affects up to 3.1.72. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record stylemixthemes.com wordfence.com
May 17, 2024Barcode Scanner with Inventory & Order Manager: Improper Privilege ManagementCVE-2024-33567 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager allows Privilege Escalation.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.3.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024XStore Core: Improper Privilege ManagementCVE-2024-33552 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in 8theme XStore Core allows Privilege Escalation.This issue affects XStore Core: from n/a through 5.3.8.
Product
XStore Core
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection')CVE-2024-32680 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUS HUSKY – Products Filter for WooCommerce (formerly WOOF) allows Using Malicious Files, Code Inclusion.This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.2.
Product
HUSKY – Products Filter for WooCommerce (formerly WOOF)
Affected
up to 1.3.5.2
What to do
Affects up to 1.3.5.2. Update HUSKY – Products Filter for WooCommerce (formerly WOOF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Download Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32131 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82.
Product
Download Manager
Affected
up to 3.2.82
What to do
Affects up to 3.2.82. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Easy Social Share Buttons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-31300 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appscreo Easy Social Share Buttons allows PHP Local File Inclusion.This issue affects Easy Social Share Buttons: from n/a through 9.4.
Product
Easy Social Share Buttons
Affected
up to 9.4
What to do
Affects up to 9.4. Update Easy Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Rehub: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-31232 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue affects Rehub: from n/a through 19.6.1.
Product
Rehub
Affected
up to 19.6.1
What to do
Affects up to 19.6.1. Update Rehub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Rehub: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-31231 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue affects Rehub: from n/a through 19.6.1.
Product
Rehub
Affected
up to 19.6.1
What to do
Affects up to 19.6.1. Update Rehub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024SellKit: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-30509 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Artbees SellKit allows Relative Path Traversal.This issue affects SellKit: from n/a through 1.8.1.
Product
SellKit
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update SellKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Automatic: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-27954 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Automatic Automatic allows Path Traversal, Server Side Request Forgery.This issue affects Automatic: from n/a through 3.92.0.
Product
Automatic
Affected
up to 3.92.0
What to do
Affects up to 3.92.0. Update Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Elementor Website Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-24934 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Elementor Elementor Website Builder allows Manipulating Web Input to File System Calls.This issue affects Elementor Website Builder: from n/a through 3.19.0.
Product
Elementor Website Builder
Affected
up to 3.19.0
What to do
Affects up to 3.19.0. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Total Upkeep: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-24869 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BoldGrid Total Upkeep allows Relative Path Traversal.This issue affects Total Upkeep: from n/a through 1.15.8.
Product
Total Upkeep
Affected
up to 1.15.8
What to do
Affects up to 1.15.8. Update Total Upkeep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Ultimate Addons for Beaver Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-51401 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Relative Path Traversal.This issue affects Ultimate Addons for Beaver Builder: from n/a through 1.35.13.
Product
Ultimate Addons for Beaver Builder
Affected
up to 1.35.13
What to do
Affects up to 1.35.13. Update Ultimate Addons for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Ultimate Addons for Elementor: Improper Privilege ManagementCVE-2023-50890 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.20.
Product
Ultimate Addons for Elementor
Affected
up to 1.36.20
What to do
Affects up to 1.36.20. Update Ultimate Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Adifier System: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-49753 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spoonthemes Adifier System allows PHP Local File Inclusion.This issue affects Adifier System: from n/a before 3.1.4.
Product
Adifier System
Fixed in
3.1.4
What to do
Update Adifier System to 3.1.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Qi Addons For Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-47679 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QODE Interactive Qi Addons For Elementor allows PHP Local File Inclusion.This issue affects Qi Addons For Elementor: from n/a through 1.6.3.
Product
Qi Addons For Elementor
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Qi Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024The Plus Addons for Elementor Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-47178 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows PHP Local File Inclusion.This issue affects The Plus Addons for Elementor Pro: from n/a through 5.2.8.
Product
The Plus Addons for Elementor Pro
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update The Plus Addons for Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024ICS Calendar: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF)CVE-2023-46784 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF) vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Absolute Path Traversal, : Server Side Request Forgery.This issue affects ICS Calendar: from n/a through 10.12.0.3.
Product
ICS Calendar
Affected
up to 10.12.0.3
What to do
Affects up to 10.12.0.3. Update ICS Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Ultimate Addons for WPBakery Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-46205 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows PHP Local File Inclusion.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.14.
Product
Ultimate Addons for WPBakery Page Builder
Affected
up to 3.19.14
What to do
Affects up to 3.19.14. Update Ultimate Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Popup by Supsystic: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-46197 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.This issue affects Popup by Supsystic: from n/a through 1.10.19.
Product
Popup by Supsystic
Affected
up to 1.10.19
What to do
Affects up to 1.10.19. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Remote Content Shortcode: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-45652 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Justin Silver Remote Content Shortcode allows PHP Local File Inclusion.This issue affects Remote Content Shortcode: from n/a through 1.5.
Product
Remote Content Shortcode
Affected
up to 1.5
What to do
Affects up to 1.5. Update Remote Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024XStore Core: Unrestricted Upload of File with Dangerous TypeCVE-2024-33556 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.
Product
XStore Core
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Copymatic – AI Content Writer & Generator: Unrestricted Upload of File with Dangerous TypeCVE-2024-31351 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.6.
Product
Copymatic – AI Content Writer & Generator
Affected
up to 1.6
What to do
Affects up to 1.6. Update Copymatic – AI Content Writer & Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Essential Addons for Elementor: Improper Privilege ManagementCVE-2023-41955 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8.
Product
Essential Addons for Elementor
Affected
up to 5.8.8
What to do
Affects up to 5.8.8. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Phlox Shop: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-39163 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Shop allows PHP Local File Inclusion.This issue affects Phlox Shop: from n/a through 2.0.0.
Product
Phlox Shop
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Phlox Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Phlox Portfolio: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-38399 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Portfolio allows PHP Local File Inclusion.This issue affects Phlox Portfolio: from n/a through 2.3.1.
Product
Phlox Portfolio
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Phlox Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Shortcodes and extra features for Phlox: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-37888 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in By Averta Shortcodes and extra features for Phlox theme allows PHP Local File Inclusion.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.14.0.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Consulting: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-37385 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through 6.5.6.
Product
Consulting
Affected
up to 6.5.6
What to do
Affects up to 6.5.6. Update Consulting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WooCommerce One Page Checkout: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-35881 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0.
Product
WooCommerce One Page Checkout
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WooCommerce One Page Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Unite Gallery Lite: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-33310 · WordPress plugins & themes · reported by PatchstackMedium 6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Valiano Unite Gallery Lite allows PHP Local File Inclusion.This issue affects Unite Gallery Lite: from n/a through 1.7.59.
Product
Unite Gallery Lite
Affected
up to 1.7.59
What to do
Affects up to 1.7.59. Update Unite Gallery Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024LWS Affiliation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-32297 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LWS LWS Affiliation allows PHP Local File Inclusion.This issue affects LWS Affiliation: from n/a through 2.2.6.
Product
LWS Affiliation
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update LWS Affiliation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Editorialmag: Missing AuthorizationCVE-2023-32129 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle WP Editorialmag editorialmag.This issue affects Editorialmag: from n/a through 1.1.9.
Product
Editorialmag
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Editorialmag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024JupiterX: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-32110 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in artbees JupiterX allows PHP Local File Inclusion.This issue affects JupiterX: from n/a through 3.0.0.
Product
JupiterX
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update JupiterX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Bookly: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-26526 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1.
Product
Bookly
Affected
up to 21.7.1
What to do
Affects up to 21.7.1. Update Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Shortcodes Ultimate: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-25050 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vova Anokhin Shortcodes Ultimate allows Absolute Path Traversal.This issue affects Shortcodes Ultimate: from n/a through 5.12.6.
Product
Shortcodes Ultimate
Affected
up to 5.12.6
What to do
Affects up to 5.12.6. Update Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Landing Page Builder – Free Landing Page Templates: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-24379 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Web-Settler Landing Page Builder – Free Landing Page Templates allows Path Traversal.This issue affects Landing Page Builder – Free Landing Page Templates: from n/a through 3.1.9.9.
Product
Landing Page Builder – Free Landing Page Templates
Affected
up to 3.1.9.9
What to do
Affects up to 3.1.9.9. Update Landing Page Builder – Free Landing Page Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Rank Math SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-23888 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rank Math Rank Math SEO allows Path Traversal.This issue affects Rank Math SEO: from n/a through 1.0.107.2.
Product
Rank Math SEO
Affected
up to 1.0.107.2
What to do
Affects up to 1.0.107.2. Update Rank Math SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.