Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,084 results · page 14 of 22
Oct 5, 2024WP Ticket Ultra Help Desk & Support: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExpressTech Systems WP Ticket Ultra Help Desk & Support Plugin wp-ticket-ultra allows PHP Local File Inclusion.This issue affects WP Ticket Ultra Help Desk & Support Plugin: from n/a through <= 1.0.5.
- Product
- WP Ticket Ultra Help Desk & Support
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WP Ticket Ultra Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Cross-Site Request ForgeryCVE-2024-8520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the admin_init or user_action_hook function. This makes it possible for unauthenticated attackers to modify a users membership status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2024-8519 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'um_loggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2024Social Web Suite – Social Media Auto Post, Social Media Auto Publish: Directory TraversalCVE-2024-8352 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Social Web Suite – Social Media Auto Post, Social Media Auto Publish
- Affected
- up to 4.1.11
- What to do
- Affects up to 4.1.11. Update Social Web Suite – Social Media Auto Post, Social Media Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2024Checkout Mestres WP: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44030 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Absolute Path Traversal.This issue affects Checkout Mestres WP: from n/a through <= 8.6.
- Product
- Checkout Mestres WP
- Affected
- up to 8.6
- What to do
- Affects up to 8.6. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2024MH Board: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44017 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MinHyeong Lim MH Board mh-board allows PHP Local File Inclusion.This issue affects MH Board: from n/a through <= 1.3.2.1.
- Product
- MH Board
- Affected
- up to 1.3.2.1
- What to do
- Affects up to 1.3.2.1. Update MH Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2024ElementsKit Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.This issue affects ElementsKit Pro: from n/a through 3.6.0.
- Product
- ElementsKit Pro
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update ElementsKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Name Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.29.0.
- Product
- Name Directory
- Affected
- up to 1.29.0
- What to do
- Affects up to 1.29.0. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2024Classified Listing – Classified ads & Business Directory: Unauthorized accessCVE-2024-7888 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions like export_forms(), import_forms(), update_fb_options(), and many more in all versions up to, and including, 3.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify forms and various other settings.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Directory TraversalCVE-2024-8104 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the download_file_ajax function. This makes it possible for authenticated attackers, with subscriber access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- The Ultimate WordPress Toolkit – WP Extended
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2024Web Directory Free: Does not validate a parameter before using it in an include()CVE-2024-3673 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.
- Product
- Web Directory Free
- Fixed in
- 1.7.3
- What to do
- Update Web Directory Free to 1.7.3 or newer.
Aug 29, 2024Animated Number Counters: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43957 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sk. Abul Hasan Animated Number Counters allows PHP Local File Inclusion.This issue affects Animated Number Counters: from n/a through 1.9.
- Product
- Animated Number Counters
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Animated Number Counters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024Droip: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43955 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip: from n/a through 1.1.1.
- Product
- Droip
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Landing Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43345 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion.This issue affects Landing Page Builder: from n/a through 1.5.2.0.
- Product
- Landing Page Builder
- Affected
- up to 1.5.2.0
- What to do
- Affects up to 1.5.2.0. Update Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024EmbedPress: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43328 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress allows PHP Local File Inclusion.This issue affects EmbedPress: from n/a through 4.0.9.
- Product
- EmbedPress
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Void Elementor Post Grid Addon for Elementor Page builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43281 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VOID CODERS Void Elementor Post Grid Addon for Elementor Page builder allows PHP Local File Inclusion.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through 2.3.
- Product
- Void Elementor Post Grid Addon for Elementor Page builder
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Void Elementor Post Grid Addon for Elementor Page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Woo Products Widgets For Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43271 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themelocation Woo Products Widgets For Elementor allows PHP Local File Inclusion.This issue affects Woo Products Widgets For Elementor: from n/a through 2.0.0.
- Product
- Woo Products Widgets For Elementor
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Woo Products Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Bit Form Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43248 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.This issue affects Bit Form Pro: from n/a through 2.6.4.
- Product
- Bit Form Pro
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Bit Form Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Timeline and History slider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43232 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP OnlineSupport, Essential Plugin Timeline and History slider allows PHP Local File Inclusion.This issue affects Timeline and History slider: from n/a through 2.3.
- Product
- Timeline and History slider
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Timeline and History slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024JetGridBuilder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43221 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetGridBuilder allows PHP Local File Inclusion.This issue affects JetGridBuilder: from n/a through 1.1.2.
- Product
- JetGridBuilder
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update JetGridBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024GeoDirectory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43145 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory: from n/a through 2.3.61.
- Product
- GeoDirectory
- Affected
- up to 2.3.61
- What to do
- Affects up to 2.3.61. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 17, 2024BackWPup: Directory TraversalCVE-2023-5505 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.
- Product
- BackWPup
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update BackWPup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2024WPSection: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43165 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rashid87 WPSection allows PHP Local File Inclusion.This issue affects WPSection: from n/a through 1.3.8.
- Product
- WPSection
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update WPSection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024Ultimate Bootstrap Elements for Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43140 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.4.
- Product
- Ultimate Bootstrap Elements for Elementor
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Ultimate Bootstrap Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024Event Manager for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43138 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1.
- Product
- Event Manager for WooCommerce
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Event Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024WPCafe: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43135 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through 2.2.28.
- Product
- WPCafe
- Affected
- up to 2.2.28
- What to do
- Affects up to 2.2.28. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024BetterDocs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43129 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper BetterDocs allows PHP Local File Inclusion.This issue affects BetterDocs: from n/a through 3.5.8.
- Product
- BetterDocs
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024WooCommerce PDF Vouchers: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39651 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPWeb WooCommerce PDF Vouchers allows File Manipulation.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.
- Product
- WooCommerce PDF Vouchers
- Fixed in
- 4.9.5
- What to do
- Update WooCommerce PDF Vouchers to 4.9.5 or newer.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39624 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39621 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39619 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024JetWidgets for Elementor and WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38772 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP Local File Inclusion.This issue affects JetWidgets for Elementor and WooCommerce: from n/a through 1.1.7.
- Product
- JetWidgets for Elementor and WooCommerce
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update JetWidgets for Elementor and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024The Pack Elementor addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38768 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Webangon The Pack Elementor addons allows PHP Local File Inclusion, Path Traversal.This issue affects The Pack Elementor addons: from n/a through 2.0.8.6.
- Product
- The Pack Elementor addons
- Affected
- up to 2.0.8.6
- What to do
- Affects up to 2.0.8.6. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024MakeStories (for Google Web Stories): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MakeStories Team MakeStories (for Google Web Stories) allows Path Traversal, Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through 3.0.3.
- Product
- MakeStories (for Google Web Stories)
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update MakeStories (for Google Web Stories) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Web Directory Free: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3669 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Web Directory Free
- Fixed in
- 1.7.2
- What to do
- Update Web Directory Free to 1.7.2 or newer.
Jul 30, 2024pmpro-member-directory: Does not prevent users with at least the contributor role from leaking other users' sensitive informationCVE-2024-1287 · WordPress plugins & themes · reported by WPScanMedium 6.5
The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.
- Product
- pmpro-member-directory
- Fixed in
- 1.2.6
- What to do
- Update pmpro-member-directory to 1.2.6 or newer.
Jul 22, 2024DirectoryPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38755 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Designinvento DirectoryPress allows SQL Injection.This issue affects DirectoryPress: from n/a through 3.6.10.
- Product
- DirectoryPress
- Affected
- up to 3.6.10
- What to do
- Affects up to 3.6.10. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 21, 2024WP Directory Kit: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37487 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpdirectorykit.Com WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.3.5.
- Product
- WP Directory Kit
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 16, 2024WordPress File Upload: Directory TraversalCVE-2024-5852 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'uploadpath' parameter of the wordpress_file_upload shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload limited files to arbitrary locations on the web server.
- Product
- WordPress File Upload
- Affected
- up to 4.24.7
- What to do
- Affects up to 4.24.7. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 12, 2024Booking Ultra Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38717 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Booking Ultra Pro allows PHP Local File Inclusion.This issue affects Booking Ultra Pro: from n/a through 1.1.13.
- Product
- Booking Ultra Pro
- Affected
- up to 1.1.13
- What to do
- Affects up to 1.1.13. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024Events Calendar for Google: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38716 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blue Plugins Events Calendar for Google allows PHP Local File Inclusion.This issue affects Events Calendar for Google: from n/a through 2.1.0.
- Product
- Events Calendar for Google
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Events Calendar for Google to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024ExS Widgets: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38715 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExS ExS Widgets allows PHP Local File Inclusion.This issue affects ExS Widgets: from n/a through 0.3.1.
- Product
- ExS Widgets
- Affected
- up to 0.3.1
- What to do
- Affects up to 0.3.1. Update ExS Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024GD Rating System: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38709 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Milan Petrovic GD Rating System allows PHP Local File Inclusion.This issue affects GD Rating System: from n/a through 3.6.
- Product
- GD Rating System
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024WordPress Team Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38704 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DynamicWebLab WordPress Team Manager allows PHP Local File Inclusion.This issue affects WordPress Team Manager: from n/a through 2.1.12.
- Product
- WordPress Team Manager
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update WordPress Team Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024Woocommerce OpenPos: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37932 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in anhvnit Woocommerce OpenPos allows File Manipulation.This issue affects Woocommerce OpenPos: from n/a through 6.4.4.
- Product
- Woocommerce OpenPos
- Affected
- up to 6.4.4
- What to do
- Affects up to 6.4.4. Update Woocommerce OpenPos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024Jobmonster: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37928 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NooTheme Jobmonster allows File Manipulation.This issue affects Jobmonster: from n/a through 4.7.0.
- Product
- Jobmonster
- Affected
- up to 4.7.0
- What to do
- Affects up to 4.7.0. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2024Simple Video Directory: Does not sanitise and escape some of its settingsCVE-2024-5811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Video Directory WordPress plugin before 1.4.4 does not sanitise and escape some of its settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Video Directory
- Fixed in
- 1.4.4
- What to do
- Update Simple Video Directory to 1.4.4 or newer.
Jul 9, 2024Advanced File Manager Shortcodes: Directory TraversalCVE-2023-7062 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Advanced File Manager Shortcodes
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Advanced File Manager Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordadvancedfilemanager.comwordfence.com
Jul 9, 2024WPCafe: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37513 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPCafe: from n/a through 2.2.27.
- Product
- WPCafe
- Affected
- up to 2.2.27
- What to do
- Affects up to 2.2.27. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 9, 2024Advanced Classifieds & Directory Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37501 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Traversal.This issue affects Advanced Classifieds & Directory Pro: from n/a through 3.1.3.
- Product
- Advanced Classifieds & Directory Pro
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.