Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,454 results · page 15 of 30
Feb 27, 2025ThemeMakers PayPal Express Checkout: Stored Cross-Site ScriptingCVE-2025-1689 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ThemeMakers PayPal Express Checkout
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update ThemeMakers PayPal Express Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comthemeforest.net
Feb 24, 2025Direct Checkout Button for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27347 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techmix Direct Checkout Button for WooCommerce woo-direct-checkout-button allows Stored XSS.This issue affects Direct Checkout Button for WooCommerce: from n/a through <= 1.0.
- Product
- Direct Checkout Button for WooCommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Direct Checkout Button for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2025Age Verification for your checkout page.CVE-2025-22622 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 4.3
Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/class-wc-integration-agechecker-integration.php.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfluidattacks.comwordpress.org
Feb 7, 2025WP Spell Check: Cross-Site Request Forgery (CSRF)CVE-2025-25111 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Cross Site Request Forgery.This issue affects WP Spell Check: from n/a through <= 9.21.
- Product
- WP Spell Check
- Affected
- up to 9.21
- What to do
- Affects up to 9.21. Update WP Spell Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2025LikeBot: Does not have CSRF check in some placesCVE-2025-0522 · WordPress plugins & themes · reported by WPScanMedium 4.7
The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- LikeBot
- Affected
- up to 0.85
- What to do
- Affects up to 0.85. Update LikeBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025WP24 Domain Check: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24602 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP24 WP24 Domain Check wp24-domain-check allows Reflected XSS.This issue affects WP24 Domain Check: from n/a through <= 1.10.14.
- Product
- WP24 Domain Check
- Affected
- up to 1.10.14
- What to do
- Affects up to 1.10.14. Update WP24 Domain Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not have CSRF check in some placesCVE-2024-13115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- WP Projects Portfolio with Client Testimonials
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2025WP Finance: Does not have CSRF check in some placesCVE-2024-13096 · WordPress plugins & themes · reported by WPScanMedium 4.6
The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- WP Finance
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update WP Finance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Bulk Me Now!: Does not have CSRF checks in some placesCVE-2024-12709 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
- Product
- Bulk Me Now!
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Bulk Me Now! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dyn Business Panel: Does not have CSRF check in some placesCVE-2024-13057 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dyn Business Panel WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Dyn Business Panel
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Altra Side Menu: Does not have CSRF checks in some placesCVE-2024-12774 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Altra Side Menu WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary menu via a CSRF attack
- Product
- Altra Side Menu
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Altra Side Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WP Customer Area: Does not have CSRF checks in some placesCVE-2024-12436 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- WP Customer Area
- Affected
- up to 8.2.4
- What to do
- Affects up to 8.2.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WP Customer Area: Does not have CSRF check in placeCVE-2024-12280 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack
- Product
- WP Customer Area
- Affected
- up to 8.2.4
- What to do
- Affects up to 8.2.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Tamara Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23997 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tamara Solution Tamara Checkout tamara-checkout allows Stored XSS.This issue affects Tamara Checkout: from n/a through < 1.9.9.1.
- Product
- Tamara Checkout
- What to do
- Update Tamara Checkout to the newest version.
Jan 17, 2025Checkout for PayPal: Stored Cross-Site ScriptingCVE-2024-13398 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'checkout_for_paypal' shortcode in all versions up to, and including, 1.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Checkout for PayPal
- Affected
- up to 1.0.32
- What to do
- Affects up to 1.0.32. Update Checkout for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2025WP-BlackCheck: Cross-Site Request Forgery (CSRF)CVE-2025-23511 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Stargazer WP-BlackCheck wp-blackcheck allows Stored XSS.This issue affects WP-BlackCheck: from n/a through <= 2.7.2.
- Product
- WP-BlackCheck
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update WP-BlackCheck to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 11, 2025Dominion – Domain Checker for WPBakery: Stored Cross-Site ScriptingCVE-2024-12520 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dominion – Domain Checker for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dominion_shortcodes_domain_search_6' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Dominion – Domain Checker for WPBakery
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Dominion – Domain Checker for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 9, 2025wp Hosting Performance Check: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22521 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Farrell wp Hosting Performance Check wp-hosting-performance-check allows Reflected XSS.This issue affects wp Hosting Performance Check: from n/a through <= 2.18.8.
- Product
- wp Hosting Performance Check
- Affected
- up to 2.18.8
- What to do
- Affects up to 2.18.8. Update wp Hosting Performance Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Woocommerce check pincode/zipcode for shipping: Cross-Site Request ForgeryCVE-2024-12218 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Woocommerce check pincode/zipcode for shipping
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Woocommerce check pincode/zipcode for shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 2, 2025Broken Link Checker | Finder: Missing AuthorizationCVE-2023-46082 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cyberlord92 Broken Link Checker | Finder broken-link-finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Checker | Finder: from n/a through <= 2.4.2.
- Product
- Broken Link Checker | Finder
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Broken Link Checker | Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 27, 2024DN Shipping by Weight for WooCommerce: Does not have CSRF check in placeCVE-2024-11842 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- DN Shipping by Weight for WooCommerce
- Fixed in
- 1.2
- What to do
- Update DN Shipping by Weight for WooCommerce to 1.2 or newer.
Dec 26, 2024Broken Link Checker: Does not validate a the link URLs before making a request to themCVE-2024-10903 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
- Product
- Broken Link Checker
- Fixed in
- 2.4.2
- What to do
- Update Broken Link Checker to 2.4.2 or newer.
Dec 25, 2024Jetpack: Does not properly checks the postmessage origin in its 13CVE-2024-10858 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.
- Product
- Jetpack
- Fixed in
- 14.1
- What to do
- Update Jetpack to 14.1 or newer.
Dec 24, 2024Database Backup and check Tables Automated With Scheduler 2024: Directory TraversalCVE-2024-12850 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the database_backup_ajax_download() function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Database Backup and check Tables Automated With Scheduler 2024
- Affected
- up to 2.32
- What to do
- Affects up to 2.32. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Dec 21, 2024GTPayment Donations: Does not have CSRF check in some placesCVE-2024-11607 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- GTPayment Donations
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update GTPayment Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Broken Link Checker | Finder: Blind Server-Side Request ForgeryCVE-2024-12121 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the 'moblc_check_link' function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Broken Link Checker | Finder
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Broken Link Checker | Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2024Cost Calculator Builder: Does not have CSRF checks in some AJAX actionsCVE-2024-10892 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
- Product
- Cost Calculator Builder
- Fixed in
- 3.2.43
- What to do
- Update Cost Calculator Builder to 3.2.43 or newer.
Dec 17, 2024WooCommerce Additional Fees On Checkout (Free): Reflected Cross-Site ScriptingCVE-2024-12395 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Additional Fees On Checkout (Free) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WooCommerce Additional Fees On Checkout (Free)
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update WooCommerce Additional Fees On Checkout (Free) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2024Events Calendar: Is missing access checks in the REST APICVE-2024-5333 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
- Product
- Events Calendar
- Fixed in
- 6.8.2.1
- What to do
- Update Events Calendar to 6.8.2.1 or newer.
Dec 13, 2024Check Pincode For Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54333 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Check Pincode For Woocommerce check-pincode-for-woocommerce allows Reflected XSS.This issue affects Check Pincode For Woocommerce: from n/a through <= 1.1.
- Product
- Check Pincode For Woocommerce
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Check Pincode For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024BitPay Checkout for WooCommerce: Missing AuthorizationCVE-2023-41803 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BitPay BitPay Checkout for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BitPay Checkout for WooCommerce: from n/a through 4.1.0.
- Product
- BitPay Checkout for WooCommerce
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update BitPay Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Checkout with Zelle on Woocommerce: Missing AuthorizationCVE-2023-37969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in The African Boss Checkout with Zelle on Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout with Zelle on Woocommerce: from n/a through 3.1.
- Product
- Checkout with Zelle on Woocommerce
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Checkout with Zelle on Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Flexible Woocommerce Checkout Field Editor: Missing AuthorizationCVE-2023-49817 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in heoLixfy Flexible Woocommerce Checkout Field Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Woocommerce Checkout Field Editor: from n/a through 2.0.1.
- Product
- Flexible Woocommerce Checkout Field Editor
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Flexible Woocommerce Checkout Field Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 20243DPrint Lite: Does not have CSRF check in placeCVE-2024-10480 · WordPress plugins & themes · reported by WPScanMedium 4.3
The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- 3DPrint Lite
- Fixed in
- 2.1
- What to do
- Update 3DPrint Lite to 2.1 or newer.
Nov 23, 2024Checkout with Cash App on WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Checkout with Cash App on WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wp_http_referer' parameter in several files in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Checkout with Cash App on WooCommerce
- Affected
- up to 6.0.2
- What to do
- Affects up to 6.0.2. Update Checkout with Cash App on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 22, 2024Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net: Reflected Cross-Site ScriptingCVE-2024-11362 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.112.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net
- Affected
- up to 1.112.0
- What to do
- Affects up to 1.112.0. Update Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2024Alphabetical List: Does not have CSRF check in placeCVE-2024-8157 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Alphabetical List
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Alphabetical List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2024CM Table Of Contents: Does not have CSRF checkCVE-2024-5029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- CM Table Of Contents
- Fixed in
- 1.2.4
- What to do
- Update CM Table Of Contents to 1.2.4 or newer.
Nov 20, 2024Xpresslane Fast Checkout: Deserialization of Untrusted DataCVE-2024-52440 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issue affects Xpresslane Fast Checkout: from n/a through <= 1.0.0.
- Product
- Xpresslane Fast Checkout
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Xpresslane Fast Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Elfsight Telegram Chat CC: Unauthorized modification of data to a missing capability check on the 'updatePreferences' functionCVE-2024-10390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences' function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Elfsight Telegram Chat CC
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Elfsight Telegram Chat CC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 18, 2024CM Table Of Contents: Does not have CSRF check in placeCVE-2024-5030 · WordPress plugins & themes · reported by WPScanLow 3.8
The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- CM Table Of Contents
- Fixed in
- 1.2.3
- What to do
- Update CM Table Of Contents to 1.2.3 or newer.
Nov 15, 2024Simple Local Avatars: Unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache functionCVE-2024-10786 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear user caches.
- Product
- Simple Local Avatars
- Affected
- up to 2.7.11
- What to do
- Affects up to 2.7.11. Update Simple Local Avatars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 5, 2024Post From Frontend: Does not have CSRF checkCVE-2024-9689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack
- Product
- Post From Frontend
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Post From Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Checkout Field Editor (Checkout Manager) for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-8499 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Checkout Field Editor (Checkout Manager) for WooCommerce
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Checkout Field Editor (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2024Checkout Mestres WP: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44030 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Absolute Path Traversal.This issue affects Checkout Mestres WP: from n/a through <= 8.6.
- Product
- Checkout Mestres WP
- Affected
- up to 8.6
- What to do
- Affects up to 8.6. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2024Broken Link Checker: Reflected Cross-Site ScriptingCVE-2024-8981 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Broken Link Checker
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2024adstxt: Does not have CSRF check in placeCVE-2024-7892 · WordPress plugins & themes · reported by WPScanMedium 4.3
The adstxt Plugin WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- adstxt
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update adstxt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Posts reminder: Does not have CSRF check in placeCVE-2024-8093 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Posts reminder
- Affected
- up to 0.20
- What to do
- Affects up to 0.20. Update Posts reminder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Accordion Image Menu: Does not have CSRF check in some placesCVE-2024-8092 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Accordion Image Menu
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Accordion Image Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Enhanced Search Box: Does not have CSRF check in placeCVE-2024-8091 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Enhanced Search Box
- Affected
- up to 0.6.1
- What to do
- Affects up to 0.6.1. Update Enhanced Search Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.