Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

323new WordPress flaws this week

393,460entries in the database

8,939 results · page 148 of 179

May 17, 2024GiveWP: Improper Privilege ManagementCVE-2023-41665 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in GiveWP allows Privilege Escalation.This issue affects GiveWP: from n/a through 2.33.0.
Product
GiveWP
Affected
up to 2.33.0
What to do
Affects up to 2.33.0. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WPvivid Backup and Migration: Improper Privilege ManagementCVE-2023-41243 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in WPvivid Team WPvivid Backup and Migration allows Privilege Escalation.This issue affects WPvivid Backup and Migration: from n/a through 0.9.90.
Product
WPvivid Backup and Migration
Affected
up to 0.9.90
What to do
Affects up to 0.9.90. Update WPvivid Backup and Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Phlox Shop: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-39163 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Shop allows PHP Local File Inclusion.This issue affects Phlox Shop: from n/a through 2.0.0.
Product
Phlox Shop
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Phlox Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Phlox Portfolio: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-38399 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Portfolio allows PHP Local File Inclusion.This issue affects Phlox Portfolio: from n/a through 2.3.1.
Product
Phlox Portfolio
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Phlox Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024HT Mega: Improper Privilege ManagementCVE-2023-37999 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in HasThemes HT Mega allows Privilege Escalation.This issue affects HT Mega: from n/a through 2.2.0.
Product
HT Mega
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update HT Mega to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Shortcodes and extra features for Phlox: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-37888 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in By Averta Shortcodes and extra features for Phlox theme allows PHP Local File Inclusion.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.14.0.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024JetFormBuilder: Improper Privilege ManagementCVE-2023-37866 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Privilege Management vulnerability in Crocoblock JetFormBuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.0.8.
Product
JetFormBuilder
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Booking Package: Improper Privilege ManagementCVE-2023-37389 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in SAASPROJECT Booking Package Booking Package allows Privilege Escalation.This issue affects Booking Package: from n/a through 1.5.98.
Product
Booking Package
Affected
up to 1.5.98
What to do
Affects up to 1.5.98. Update Booking Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Consulting: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-37385 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through 6.5.6.
Product
Consulting
Affected
up to 6.5.6
What to do
Affects up to 6.5.6. Update Consulting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WooCommerce One Page Checkout: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-35881 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0.
Product
WooCommerce One Page Checkout
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WooCommerce One Page Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Unite Gallery Lite: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-33310 · WordPress plugins & themes · reported by PatchstackMedium 6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Valiano Unite Gallery Lite allows PHP Local File Inclusion.This issue affects Unite Gallery Lite: from n/a through 1.7.59.
Product
Unite Gallery Lite
Affected
up to 1.7.59
What to do
Affects up to 1.7.59. Update Unite Gallery Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024LWS Affiliation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-32297 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LWS LWS Affiliation allows PHP Local File Inclusion.This issue affects LWS Affiliation: from n/a through 2.2.6.
Product
LWS Affiliation
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update LWS Affiliation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Woodmart Core: Improper Privilege ManagementCVE-2023-32244 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in xtemos Woodmart Core allows Privilege Escalation.This issue affects Woodmart Core: from n/a through 1.0.36.
Product
Woodmart Core
Affected
up to 1.0.36
What to do
Affects up to 1.0.36. Update Woodmart Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024JupiterX: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-32110 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in artbees JupiterX allows PHP Local File Inclusion.This issue affects JupiterX: from n/a through 3.0.0.
Product
JupiterX
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update JupiterX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Houzez: Improper Privilege ManagementCVE-2023-26540 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1.
Product
Houzez
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Bookly: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-26526 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1.
Product
Bookly
Affected
up to 21.7.1
What to do
Affects up to 21.7.1. Update Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Houzez Login Register: Improper Privilege ManagementCVE-2023-26009 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Favethemes Houzez Login Register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through 2.6.3.
Product
Houzez Login Register
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update Houzez Login Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WatchTowerHQ: Improper Privilege ManagementCVE-2023-25701 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in WhatArmy WatchTowerHQ allows Privilege Escalation.This issue affects WatchTowerHQ: from n/a through 3.6.16.
Product
WatchTowerHQ
Affected
up to 3.6.16
What to do
Affects up to 3.6.16. Update WatchTowerHQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Shortcodes Ultimate: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-25050 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vova Anokhin Shortcodes Ultimate allows Absolute Path Traversal.This issue affects Shortcodes Ultimate: from n/a through 5.12.6.
Product
Shortcodes Ultimate
Affected
up to 5.12.6
What to do
Affects up to 5.12.6. Update Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Landing Page Builder – Free Landing Page Templates: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-24379 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Web-Settler Landing Page Builder – Free Landing Page Templates allows Path Traversal.This issue affects Landing Page Builder – Free Landing Page Templates: from n/a through 3.1.9.9.
Product
Landing Page Builder – Free Landing Page Templates
Affected
up to 3.1.9.9
What to do
Affects up to 3.1.9.9. Update Landing Page Builder – Free Landing Page Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Redirection for Contact Form 7: Improper Privilege ManagementCVE-2023-23990 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Privilege Management vulnerability in Qube One Ltd. Redirection for Contact Form 7 wpcf7-redirect allows Privilege Escalation.This issue affects Redirection for Contact Form 7: from n/a through 2.7.0.
Product
Redirection for Contact Form 7
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Rank Math SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-23888 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rank Math Rank Math SEO allows Path Traversal.This issue affects Rank Math SEO: from n/a through 1.0.107.2.
Product
Rank Math SEO
Affected
up to 1.0.107.2
What to do
Affects up to 1.0.107.2. Update Rank Math SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024GMAce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-23872 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in German Mesky GMAce allows Path Traversal.This issue affects GMAce: from n/a through 1.5.2.
Product
GMAce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update GMAce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024OceanWP: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-23700 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OceanWP allows PHP Local File Inclusion.This issue affects OceanWP: from n/a through 3.4.1.
Product
OceanWP
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update OceanWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024MainWP Code Snippets Extension: Improper Control of Generation of Code ('Code Injection')CVE-2023-23645 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in MainWP MainWP Code Snippets Extension allows Code Injection.This issue affects MainWP Code Snippets Extension: from n/a through 4.0.2.
Product
MainWP Code Snippets Extension
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update MainWP Code Snippets Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024YARPP: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2022-45374 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YARPP allows PHP Local File Inclusion.This issue affects YARPP: from n/a through 5.30.4.
Product
YARPP
Affected
up to 5.30.4
What to do
Affects up to 5.30.4. Update YARPP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 20241003 Mortgage Application: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2022-45368 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Lenderd 1003 Mortgage Application allows Relative Path Traversal.This issue affects 1003 Mortgage Application: from n/a through 1.75.
Product
1003 Mortgage Application
Affected
up to 1.75
What to do
Affects up to 1.75. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Borderless: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34757 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visualmodo Borderless borderless allows DOM-Based XSS.This issue affects Borderless: from n/a through <= 1.7.3.
Product
Borderless
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Borderless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Landing Page Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34752 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Reflected XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.8.
Product
Landing Page Builder
Affected
up to 1.5.1.8
What to do
Affects up to 1.5.1.8. Update Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024DethemeKit For Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34575 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.1.2.
Product
DethemeKit For Elementor
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Popup Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34567 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29.
Product
Popup Builder
Affected
up to 1.1.29
What to do
Affects up to 1.1.29. Update Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Popup More Popups: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-32800 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Felix Moira Popup More Popups allows Stored XSS.This issue affects Popup More Popups: from n/a through 2.3.1.
Product
Popup More Popups
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Popup More Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2024JCH Optimize: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-34808 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.2.0.
Product
JCH Optimize
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update JCH Optimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2024iFrame: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34805 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webvitaly iFrame allows Stored XSS.This issue affects iFrame: from n/a through 5.0.
Product
iFrame
Affected
up to 5.0
What to do
Affects up to 5.0. Update iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2024Magazine Blocks: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34760 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPBlockart Magazine Blocks allows Stored XSS.This issue affects Magazine Blocks: from n/a through 1.3.6.
Product
Magazine Blocks
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Magazine Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2024The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belongingCVE-2024-3749 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Leyka: Improper Privilege ManagementCVE-2023-33327 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.30.2.
Product
Leyka
Affected
up to 3.30.2
What to do
Affects up to 3.30.2. Update Leyka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Propovoice CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-4747 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Propovoice Propovoice CRM allows Stored XSS.This issue affects Propovoice CRM: from n/a through 1.7.6.2.
Product
Propovoice CRM
Affected
up to 1.7.6.2
What to do
Affects up to 1.7.6.2. Update Propovoice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Sticky banner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35170 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidden Depth Sticky banner allows Stored XSS.This issue affects Sticky banner: from n/a through 1.2.0.
Product
Sticky banner
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Sticky banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024All Bootstrap Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35169 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks.This issue affects All Bootstrap Blocks: from n/a through <= 1.3.15.
Product
All Bootstrap Blocks
Affected
up to 1.3.15
What to do
Affects up to 1.3.15. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Envo's Elementor Templates & Widgets for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35167 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a through 1.4.8.
Product
Envo's Elementor Templates & Widgets for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Envo's Elementor Templates & Widgets for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34811 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.5.1.
Product
WP SMS
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024SKT Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34445 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through 1.8.
Product
SKT Addons for Elementor
Affected
up to 1.8
What to do
Affects up to 1.8. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Easy Affiliate Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34441 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures Easy Affiliate Links allows Stored XSS.This issue affects Easy Affiliate Links: from n/a through 3.7.2.
Product
Easy Affiliate Links
Affected
up to 3.7.2
What to do
Affects up to 3.7.2. Update Easy Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34437 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.24.
Product
Form Maker by 10Web
Affected
up to 1.15.24
What to do
Affects up to 1.15.24. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024SKT Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34436 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through 1.8.
Product
SKT Addons for Elementor
Affected
up to 1.8
What to do
Affects up to 1.8. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Better Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34432 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BetterAddons Better Elementor Addons better-elementor-addons allows Stored XSS.This issue affects Better Elementor Addons: from n/a through 1.4.4.
Product
Better Elementor Addons
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Better Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP etracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-etracker WP etracker allows Reflected XSS.This issue affects WP etracker: from n/a through 1.0.2.
Product
WP etracker
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP etracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024TT Custom Post Type Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34430 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rashed Latif TT Custom Post Type Creator allows Stored XSS.This issue affects TT Custom Post Type Creator: from n/a through 1.0.
Product
TT Custom Post Type Creator
Affected
up to 1.0
What to do
Affects up to 1.0. Update TT Custom Post Type Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Corona Virus (COVID-19) Banner & Live Data: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34429 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data allows Stored XSS.This issue affects Corona Virus (COVID-19) Banner & Live Data: from n/a through 1.8.0.2.
Product
Corona Virus (COVID-19) Banner & Live Data
Affected
up to 1.8.0.2
What to do
Affects up to 1.8.0.2. Update Corona Virus (COVID-19) Banner & Live Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.