Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

954 results · page 15 of 20

Apr 9, 2024Ecwid Ecommerce Shopping Cart: Stored Cross-Site ScriptingCVE-2024-2456 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 6.12.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ecwid Ecommerce Shopping Cart
Affected
up to 6.12.10
What to do
Affects up to 6.12.10. Update Ecwid Ecommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 3, 2024WooCommerce Cart Abandonment Recovery: Does not have CSRF check in its bulk actionsCVE-2024-2322 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.
Product
WooCommerce Cart Abandonment Recovery
Fixed in
1.2.27
What to do
Update WooCommerce Cart Abandonment Recovery to 1.2.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 31, 2024Contributor Cross Site Scripting (XSS) in HeartThis <= 0.1.0 versions.CVE-2024-31121 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in HeartThis <= 0.1.0 versions.
Affected
up to 0.1.0
What to do
Affects up to 0.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Popup Cart Lite for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-31100 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Festi-Team Popup Cart Lite for WooCommerce.This issue affects Popup Cart Lite for WooCommerce: from n/a through 1.1.
Product
Popup Cart Lite for WooCommerce
Affected
up to 1.1
What to do
Affects up to 1.1. Update Popup Cart Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Sunshine Photo Cart: Deserialization of Untrusted DataCVE-2024-30221 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.
Product
Sunshine Photo Cart
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Starter Templates — Elementor, WordPress & Beaver Builder Templates: Server-Side Request Forgery (SSRF)CVE-2023-34370 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Premium Starter Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4; Premium Starter Templates: from n/a through 3.2.4.
Product
Starter Templates — Elementor, WordPress & Beaver Builder Templates
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Starter Templates — Elementor, WordPress & Beaver Builder Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Funnel Builder by CartFlows: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29813 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CartFlows Inc. Funnel Builder by CartFlows allows Stored XSS.This issue affects Funnel Builder by CartFlows: from n/a through 2.0.1.
Product
Funnel Builder by CartFlows
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Funnel Builder by CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Sunshine Photo Cart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30194 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.
Product
Sunshine Photo Cart
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Website Article Monetization By MageNet: Stored Cross-Site ScriptingCVE-2024-1379 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Website Article Monetization By MageNet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'abp_auth_key' parameter in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping and a missing authorization check. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Website Article Monetization By MageNet
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Website Article Monetization By MageNet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2024Smart Custom Fields: Unauthorized access of dataCVE-2024-1995 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 4.2.2. This makes it possible for authenticated attackers, with subscrber-level access and above, to retrieve post content that is password protected and/or private.
Product
Smart Custom Fields
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update Smart Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 19, 2024Smart Online Order for Clover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29115 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart Online Order for Clover allows Stored XSS.This issue affects Smart Online Order for Clover: from n/a through 1.5.5.
Product
Smart Online Order for Clover
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart) plugin for WordPress is vulnerCVE-2024-2286 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link URL value in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024WooCommerce Add to Cart Custom Redirect: Unauthorized modification of data and loss of dataCVE-2024-1862 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wcr_dismiss_admin_notice' function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with contributor access and above, to update the values of arbitrary site options to 'dismissed'.
Product
WooCommerce Add to Cart Custom Redirect
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update WooCommerce Add to Cart Custom Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds: Unauthorized access of dataCVE-2024-1690 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the terawallet_export_user_search() function in all versions up to, and including, 1.4.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to export a list of registered users and their emails.
Product
TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts: Reflected Cross-Site ScriptingCVE-2024-0591 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'A' parameter in all versions up to, and including, 3.4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts
Affected
up to 3.4.2.2
What to do
Affects up to 3.4.2.2. Update wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Mar 13, 2024ArtiBot Free Chat Bot for WordPress WebSites: Stored Cross-Site ScriptingCVE-2024-0449 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ArtiBot Free Chat Bot for WordPress WebSites
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update ArtiBot Free Chat Bot for WordPress WebSites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024ArtiBot Free Chat Bot for WordPress WebSites: Unauthorized modification of dataCVE-2024-0447 · WordPress plugins & themes · reported by WordfenceMedium 5
The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the artibot_update function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update plugin settings.
Product
ArtiBot Free Chat Bot for WordPress WebSites
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update ArtiBot Free Chat Bot for WordPress WebSites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Sunshine Photo Cart: Free Client Galleries for Photographers: Sensitive Information ExposureCVE-2024-1294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'. This makes it possible for unauthenticated attackers to extract sensitive data including customer email and physical addresses.
Product
Sunshine Photo Cart: Free Client Galleries for Photographers
Affected
up to 3.0.24
What to do
Affects up to 3.0.24. Update Sunshine Photo Cart: Free Client Galleries for Photographers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Ecwid Ecommerce Shopping Cart: Cross-Site Request Forgery (CSRF)CVE-2023-51533 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a through 6.12.4.
Product
Ecwid Ecommerce Shopping Cart
Affected
up to 6.12.4
What to do
Affects up to 6.12.4. Update Ecwid Ecommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 27, 2024Smart Forms: Does not have authorisation in various AJAX actionsCVE-2023-7203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.
Product
Smart Forms
Fixed in
2.6.87
What to do
Update Smart Forms to 2.6.87 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 26, 2024WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-1436 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.This issue affects WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit: from n/a through 1.0.9.
Product
WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Smart Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0566 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
Smart Manager
Fixed in
8.28.0
What to do
Update Smart Manager to 8.28.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6082 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
chartjs
Affected
up to 2023.2
What to do
Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lynk.nl wpscan.com
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6081 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
chartjs
Affected
up to 2023.2
What to do
Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lynk.nl wpscan.com
Feb 12, 2024Chartify – WordPress Chart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47526 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chart Builder Team Chartify – WordPress Chart Plugin allows Stored XSS.This issue affects Chartify – WordPress Chart Plugin: from n/a through 2.0.6.
Product
Chartify – WordPress Chart
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Chartify – WordPress Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Shield Security – Smart Bot Blocking & Intrusion Prevention Security: Local File InclusionCVE-2023-6989 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
Product
Shield Security – Smart Bot Blocking & Intrusion Prevention Security
Affected
up to 18.5.9
What to do
Affects up to 18.5.9. Update Shield Security – Smart Bot Blocking & Intrusion Prevention Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 1, 2024Infogram – Add charts, maps and infographics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52191 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Torbjon Infogram – Add charts, maps and infographics allows Stored XSS.This issue affects Infogram – Add charts, maps and infographics: from n/a through 1.6.1.
Product
Infogram – Add charts, maps and infographics
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Infogram – Add charts, maps and infographics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Shield Security – Smart Bot Blocking & Intrusion Prevention Security: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22163 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shield Security Shield Security – Smart Bot Blocking & Intrusion Prevention Security allows Stored XSS.This issue affects Shield Security – Smart Bot Blocking & Intrusion Prevention Security: from n/a through 18.5.7.
Product
Shield Security – Smart Bot Blocking & Intrusion Prevention Security
Affected
up to 18.5.7
What to do
Affects up to 18.5.7. Update Shield Security – Smart Bot Blocking & Intrusion Prevention Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 26, 2024Meks Smart Social Widget: Stored Cross-Site ScriptingCVE-2024-0664 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meks Smart Social Widget in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Meks Smart Social Widget
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Meks Smart Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2024WordPress Simple Shopping Cart: Stored Cross-Site ScriptingCVE-2023-6497 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up to and including 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WordPress Simple Shopping Cart
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 19, 2024Smart Slider 3: Deserialization of Untrusted DataCVE-2022-45845 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9.
Product
Smart Slider 3
Affected
up to 3.5.1.9
What to do
Affects up to 3.5.1.9. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Cart2Cart: Magento to WooCommerce Migration: Missing AuthorizationCVE-2023-34379 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration: from n/a through 2.0.0.
Product
Cart2Cart: Magento to WooCommerce Migration
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Cart2Cart: Magento to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 16, 2024ArtPlacer Widget: Does not sanitize and escape the "id" parameter before submitting the queryCVE-2023-6373 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
Product
ArtPlacer Widget
Fixed in
2.20.7
What to do
Update ArtPlacer Widget to 2.20.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Ecwid Ecommerce Shopping Cart: Does not have CSRF check in placeCVE-2023-6292 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
Ecwid Ecommerce Shopping Cart
Fixed in
6.12.5
What to do
Update Ecwid Ecommerce Shopping Cart to 6.12.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 11, 2024LightStart – Maintenance Mode, Coming Soon and Landing Page Builder: Unauthorized modification of dataCVE-2023-7019 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to change page designs.
Product
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
Affected
up to 2.6.8
What to do
Affects up to 2.6.8. Update LightStart – Maintenance Mode, Coming Soon and Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 1, 2024affiliate-toolkit: Lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiverCVE-2023-5877 · WordPress plugins & themes · reported by WPScanCritical 9.8
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.
Product
affiliate-toolkit
Fixed in
3.4.3
What to do
Update affiliate-toolkit to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 28, 2023Welcart e-Commerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50847 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.
Product
Welcart e-Commerce
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Pre* Party Resource Hints: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50855 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sam Perrow Pre* Party Resource Hints.This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.
Product
Pre* Party Resource Hints
Affected
up to 1.8.18
What to do
Affects up to 1.8.18. Update Pre* Party Resource Hints to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50857 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.
Product
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Insert or Embed Articulate Content into: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50824 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Batt Insert or Embed Articulate Content into WordPress allows Stored XSS.This issue affects Insert or Embed Articulate Content into WordPress: from n/a through 4.3000000021.
Product
Insert or Embed Articulate Content into
Affected
up to 4.3000000021
What to do
Affects up to 4.3000000021. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WoodMart - Multipurpose WooCommerce: Deserialization of Untrusted DataCVE-2023-32242 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36.
Product
WoodMart - Multipurpose WooCommerce
Affected
up to 1.0.36
What to do
Affects up to 1.0.36. Update WoodMart - Multipurpose WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Sunshine Photo Cart: Free Client Galleries for Photographers: Authorization Bypass Through User-Controlled KeyCVE-2023-41796 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0.
Product
Sunshine Photo Cart: Free Client Galleries for Photographers
Fixed in
3.0.0
What to do
Update Sunshine Photo Cart: Free Client Galleries for Photographers to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Participants Database: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-48751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5.
Product
Participants Database
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Add to Cart Text Changer and Customize Button, Add Custom Icon: Cross-Site Request Forgery (CSRF)CVE-2023-49153 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart Text Changer and Customize Button, Add Custom Icon: from n/a through 2.0.
Product
Add to Cart Text Changer and Customize Button, Add Custom Icon
Affected
up to 2.0
What to do
Affects up to 2.0. Update Add to Cart Text Changer and Customize Button, Add Custom Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Product Size Chart For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-48778 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/a through 1.1.5.
Product
Product Size Chart For WooCommerce
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Product Size Chart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023SmartCrawl: Does not prevent unauthorised users from accessing password-protected posts' contentCVE-2023-5949 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
Product
SmartCrawl
Fixed in
3.8.3
What to do
Update SmartCrawl to 3.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Menu Bar Cart Icon For WooCommerce By Binary Carpenter: Cross-Site Request Forgery (CSRF)CVE-2023-49855 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in BinaryCarpenter Menu Bar Cart Icon For WooCommerce By Binary Carpenter.This issue affects Menu Bar Cart Icon For WooCommerce By Binary Carpenter: from n/a through 1.49.3.
Product
Menu Bar Cart Icon For WooCommerce By Binary Carpenter
Affected
up to 1.49.3
What to do
Affects up to 1.49.3. Update Menu Bar Cart Icon For WooCommerce By Binary Carpenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Caddy – Smart Side Cart for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tribe Interactive Caddy – Smart Side Cart for WooCommerce.This issue affects Caddy – Smart Side Cart for WooCommerce: from n/a through 1.9.7.
Product
Caddy – Smart Side Cart for WooCommerce
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update Caddy – Smart Side Cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49860 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: from n/a through 2.6.7.
Product
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Smart External Link Click Monitor [Link Log]: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49771 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Link Log] allows Reflected XSS.This issue affects Smart External Link Click Monitor [Link Log]: from n/a through 5.0.2.
Product
Smart External Link Click Monitor [Link Log]
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Smart External Link Click Monitor [Link Log] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.