Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

542new WordPress flaws this week

391,181entries in the database

1,235 results · page 16 of 25

Feb 18, 2025s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Reflected Cross-Site ScriptingCVE-2024-11376 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 241114. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 241114
What to do
Affects up to 241114. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 15, 2025Team – Team Members Showcase: Unauthorized accessCVE-2024-13439 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function in all versions up to, and including, 4.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
Team – Team Members Showcase
Affected
up to 4.4.9
What to do
Affects up to 4.4.9. Update Team – Team Members Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Feb 14, 2025Accessibility Suite: Missing AuthorizationCVE-2025-22698 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through <= 4.18.
Product
Accessibility Suite
Affected
up to 4.18
What to do
Affects up to 4.18. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 12, 2025WP Table Manager: Unauthorized accessCVE-2024-13374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptm_getFolders AJAX action in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary file names and directories.
Product
WP Table Manager
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update WP Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record joomunited.com wordfence.com
Feb 4, 2025SocialV - Social Network and Community BuddyPress: Unauthorized access of dataCVE-2024-13529 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'socialv_send_download_file' function in all versions up to, and including, 2.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download arbitrary files from the target system.
Product
SocialV - Social Network and Community BuddyPress
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update SocialV - Social Network and Community BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record assets.iqonic.design themeforest.net
Feb 3, 2025Eventer: Unauthorized access of dataCVE-2024-11134 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to download bookings, which contains customers' personal data.
Product
Eventer
Affected
up to 3.9.9
What to do
Affects up to 3.9.9. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 3, 2025Eventer: Unauthorized access of dataCVE-2024-11133 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function in all versions up to, and including, 3.9.9.5. This makes it possible for unauthenticated attackers to download event tickets.
Product
Eventer
Affected
up to 3.9.9.5
What to do
Affects up to 3.9.9.5. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 1, 2025WooCommerce Support Ticket System: Unauthorized access and loss of dataCVE-2024-13775 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list' functions in all versions up to, and including, 17.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts, and read names, emails, and capabilities of all users.
Product
WooCommerce Support Ticket System
Affected
up to 17.8
What to do
Affects up to 17.8. Update WooCommerce Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 1, 2025Custom Related Posts: Unauthorized access & modification of dataCVE-2024-12825 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actions in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to search posts and link/unlink relations.
Product
Custom Related Posts
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Custom Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 1, 2025MagicForm: Access and modification of dataCVE-2025-0939 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings.
Product
MagicForm
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update MagicForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2025WordPress Contact Forms by Cimatti: Unauthorized access of dataCVE-2024-12184 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the accua_forms_download_submitted_file() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to download other user submitted forms.
Product
WordPress Contact Forms by Cimatti
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update WordPress Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Ni Sales Commission For WooCommerce: Unauthorized accessCVE-2024-13424 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ni Sales Commission For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'niwoosc_ajax' AJAX endpoint in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and modify commission amounts.
Product
Ni Sales Commission For WooCommerce
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Ni Sales Commission For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 31, 2025Food Menu – Restaurant Menu & Online Ordering for WooCommerce: Unauthorized accessCVE-2024-13415 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function in all versions up to, and including, 5.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings.
Product
Food Menu – Restaurant Menu & Online Ordering for WooCommerce
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update Food Menu – Restaurant Menu & Online Ordering for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Jan 30, 2025Safe Ai Malware Protection for WP: Unauthorized access of dataCVE-2024-12269 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db() function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the site's database.
Product
Safe Ai Malware Protection for WP
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update Safe Ai Malware Protection for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2025Import and export users and customers: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-24689 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Retrieve Embedded Sensitive Data.This issue affects Import and export users and customers: from n/a through <= 1.27.12.
Product
Import and export users and customers
Affected
up to 1.27.12
What to do
Affects up to 1.27.12. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 25, 2025Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized accessCVE-2024-13370 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the save_addon_key_license() function in all versions up to, and including, 1.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options to a value of a valid license key.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized accessCVE-2024-13368 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the youzify_offer_banner() function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary site options to a value of one.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2025Restrict Anonymous Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1.2.
Product
Restrict Anonymous Access
Affected
up to 1.2
What to do
Affects up to 1.2. Update Restrict Anonymous Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Jobify - Job Board: Unauthorized access and modification of dataCVE-2024-13698 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_ai' and 'generate_image_via_ai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload files in an image format, and to generate AI images using the site's OpenAI key.
Product
Jobify - Job Board
Affected
up to 4.2.7
What to do
Affects up to 4.2.7. Update Jobify - Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 24, 2025Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates: Unauthorized accessCVE-2024-13335 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoder_theme_install_func() function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install a theme.
Product
Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 23, 2025Accessibility Task Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23725 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pshikli Accessibility Task Manager accessibility-task-manager allows Reflected XSS.This issue affects Accessibility Task Manager: from n/a through <= 1.2.1.
Product
Accessibility Task Manager
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Accessibility Task Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WP Hotel Booking: Unauthorized access of dataCVE-2024-13447 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a list of registered user emails.
Product
WP Hotel Booking
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025AI Power: Complete AI Pack: Unauthorized accessCVE-2024-13361 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_save_image_media function in all versions up to, and including, 1.8.96. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload image files and embed shortcode attributes in the image_alt value that will execute when sending a POST request to the attachment page.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.96
What to do
Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2025Sandbox: Unauthorized accessCVE-2024-13367 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Sandbox plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the export_download action in all versions up to, and including, 0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download an entire copy of a sandbox environment which can contain sensitive information like the wp-config.php file.
Product
Sandbox
Affected
up to 0.4
What to do
Affects up to 0.4. Update Sandbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 15, 2025Htaccess File Editor: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-22773 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Htaccess File Editor: from n/a through <= 1.0.19.
Product
Htaccess File Editor
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Htaccess File Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 14, 2025W3 Total Cache: Unauthorized access of dataCVE-2024-12365 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain the plugin's nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications.
Product
W3 Total Cache
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 10, 2025Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups: Unauthorized accessCVE-2024-12204 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create 100% off coupons, delete posts, delete leads, and update coupon statuses.
Product
Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2025Essential WP Real Estate: Unauthorized accessCVE-2024-13318 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.
Product
Essential WP Real Estate
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Essential WP Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025linkID: Unauthorized access of dataCVE-2024-12542 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
Product
linkID
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update linkID to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Link Whisper Free: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-22306 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Spencer Haws Link Whisper Free link-whisper.This issue affects Link Whisper Free: from n/a through <= 0.7.7.
Product
Link Whisper Free
Affected
up to 0.7.7
What to do
Affects up to 0.7.7. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025RSVP and Event Management: Unauthorized accessCVE-2024-12711 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_delete_attendees() and bulk_delete_questions() in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers to delete questions and attendees and for authenticated users to update question menu orders.
Product
RSVP and Event Management
Affected
up to 2.7.13
What to do
Affects up to 2.7.13. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Jupiter X Core: Unauthorized access of dataCVE-2024-12316 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to export popup templates.
Product
Jupiter X Core
Affected
up to 4.8.5
What to do
Affects up to 4.8.5. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Jupiter X Core: Unauthorized accessCVE-2024-12033 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to sync libraries
Product
Jupiter X Core
Affected
up to 4.8.5
What to do
Affects up to 4.8.5. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Accessibility by AllAccessible: Incorrect Privilege AssignmentCVE-2024-49644 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Accessibility by AllAccessible: from n/a through <= 1.3.4.
Product
Accessibility by AllAccessible
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Accessibility by AllAccessible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WordPress File Upload: Unauthorized access of dataCVE-2024-12719 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform limited path traversal to view directories and subdirectories in WordPress. Files cannot be viewed.
Product
WordPress File Upload
Affected
up to 4.24.15
What to do
Affects up to 4.24.15. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Export Import Menus: Unauthorized access of dataCVE-2024-10866 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Export Import Menus plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dsp_export_import_menus() function in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to export menu data and settings.
Product
Export Import Menus
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Export Import Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Host PHP Info: Unauthorized access of dataCVE-2024-12535 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
Product
Host PHP Info
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Host PHP Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor: Unauthorized access of dataCVE-2024-10536 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes.
Product
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Enable Accessibility: Reflected Cross-Site ScriptingCVE-2024-9208 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Enable Accessibility plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Enable Accessibility
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Enable Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025WordLift – AI powered SEO – Schema: Unauthorized accessCVE-2024-12176 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJAX action in all versions up to, and including, 3.54.2. This makes it possible for unauthenticated attackers to update the plugin's settings.
Product
WordLift – AI powered SEO – Schema
Affected
up to 3.54.2
What to do
Affects up to 3.54.2. Update WordLift – AI powered SEO – Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 7, 2025Member Access: Sensitive Information ExposureCVE-2024-11290 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Member Access plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Member Access
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Member Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 7, 2025Spacer: Unauthorized access of dataCVE-2024-10527 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motech_spacer_callback() function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view limited setting information.
Product
Spacer
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Spacer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 25, 2024WP Data Access – App, Table, Form and Chart Builder: SQL InjectionCVE-2024-12428 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'order[user_login][dir]' parameter in all versions up to, and including, 5.5.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Data Access – App, Table, Form and Chart Builder
Affected
up to 5.5.22
What to do
Affects up to 5.5.22. Update WP Data Access – App, Table, Form and Chart Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 24, 2024MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution: Unauthorized accessCVE-2024-12413 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions like 'marketking_delete_team_member', 'marketkingrejectuser', 'marketking_save_profile_settings', and many more in all versions up to, and including, 2.0.00. This makes it possible for unauthenticated attackers to delete users, update settings, approve users, and more.
Product
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
Affected
up to 2.0.00
What to do
Affects up to 2.0.00. Update MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 24, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Unauthorized access of dataCVE-2024-12190 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bitform-form-entry-edit endpoint in all versions up to, and including, 2.17.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all form submissions from other users.
Product
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
What to do
Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 24, 2024The Custom Login Page Styler – Login Protected Private Site , Change wp-admin login url , WordPress login logo , Temporary admin login access , Rename login , LCVE-2024-12594 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Custom Login Page Styler – Login Protected Private Site , Change wp-admin login url , WordPress login logo , Temporary admin login access , Rename login , Login customizer, Hide wp-login – Limit Login Attempts – Locked Site plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'lps_generate_temp_access_url' AJAX action in all versions up to, and including, 7.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to login as other users such as subscribers.
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 24, 2024WC Price History for Omnibus: Unauthorized accessCVE-2024-12617 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and modify history data.
Product
WC Price History for Omnibus
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update WC Price History for Omnibus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 24, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Unauthorized access of dataCVE-2024-12266 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to import and export product rules along with obtaining phpinfo() data
Product
ELEX WooCommerce Dynamic Pricing and Discounts
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows): Unauthorized access of dataCVE-2024-11852 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layout templates.
Product
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)
Affected
up to 5.10.12
What to do
Affects up to 5.10.12. Update Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024WP BASE Booking of Appointments, Services and Events: Unauthorized access of dataCVE-2024-12558 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive information from the database, such as the hashed administrator password.
Product
WP BASE Booking of Appointments, Services and Events
Affected
up to 4.9.2
What to do
Affects up to 4.9.2. Update WP BASE Booking of Appointments, Services and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.