Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

1,262 results · page 16 of 26

Oct 16, 2024The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to mCVE-2016-15042 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wpscan.com
Oct 16, 2024File Manager Pro: Limited JavaScript File UploadCVE-2024-8918 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024File Manager Pro: Arbitrary backup file downloads and uploadsCVE-2024-8746 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024ZoomSounds: Arbitrary file uploadsCVE-2021-4449 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.
Product
ZoomSounds
Affected
up to 5.96
What to do
Affects up to 5.96. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net github.com
Oct 15, 2024Multiline files upload for contact form 7: Unauthorized plugin deactivationCVE-2024-9891 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the mfcf7_zl_custom_handle_deactivation_plugin_form_submission() function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin and send a custom reason from the site.
Product
Multiline files upload for contact form 7
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Multiline files upload for contact form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2024Order Attachments for WooCommerce: Unauthorized limited arbitrary file uploadsCVE-2024-9756 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on the wcoa_add_attachment AJAX action in versions 2.0 to 2.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload limited file types.
Product
Order Attachments for WooCommerce
Affected
2.0 to 2.4.1
What to do
Affects 2.0 to 2.4.1. Update Order Attachments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 12, 2024WordPress File Upload: Path TraversalCVE-2024-9047 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
Product
WordPress File Upload
Affected
up to 4.24.11
What to do
Affects up to 4.24.11. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 11, 2024Increase upload file size & Maximum Execution Time limit: Reflected Cross-Site ScriptingCVE-2024-9611 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Increase upload file size & Maximum Execution Time limit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Increase upload file size & Maximum Execution Time limit
Affected
up to 2.0
What to do
Affects up to 2.0. Update Increase upload file size & Maximum Execution Time limit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor: Arbitrary file uploadsCVE-2024-9234 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.
Product
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 5, 2024Bit Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-47319 · WordPress plugins & themes · reported by PatchstackHigh 8
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form bit-form.This issue affects Bit Form: from n/a through <= 2.13.10.
Product
Bit Form
Affected
up to 2.13.10
What to do
Affects up to 2.13.10. Update Bit Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Hash Form – Drag & Drop Form Builder: Limited file uploadsCVE-2024-9417 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.
Product
Hash Form – Drag & Drop Form Builder
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Hash Form – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 5, 2024Bit File Manager – 100% Free & Open Source File Manager and Code Editor for: Limited JavaScript File UploadCVE-2024-8743 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
Product
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for
Affected
up to 6.5.7
What to do
Affects up to 6.5.7. Update Bit File Manager – 100% Free & Open Source File Manager and Code Editor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 2, 2024WP Hotel Booking: Arbitrary file uploadsCVE-2024-7855 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP Hotel Booking
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2024AVIF & SVG Uploader: Stored Cross-Site ScriptingCVE-2024-9060 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AVIF & SVG Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
AVIF & SVG Uploader
What to do
Update AVIF & SVG Uploader to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 1, 2024Wechat Social login: Arbitrary file uploadsCVE-2024-9108 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convert_remoteimage_to_local' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Wechat Social login
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Wechat Social login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 26, 2024Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions.CVE-2024-8725 · WordPress plugins & themes · reported by WordfenceMedium 6.8
Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files to any directory within the WordPress root directory, which could lead to Stored Cross-Site Scripting. The Advanced File Manager Shortcodes plugin must be installed to exploit this vulnerability.
Fixed in
5.2.9
What to do
Update the plugin to 5.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024Advanced File Manager: Arbitrary file uploadsCVE-2024-8126 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Advanced File Manager
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024Jupiter X Core: Arbitrary file uploadsCVE-2024-7772 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Jupiter X Core
Affected
up to 4.6.5
What to do
Affects up to 4.6.5. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Arbitrary file uploadsCVE-2024-8242 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files (not including PHP files) on the affected site's server which may make remote code execution possible. This can be paired with a registration endpoint for unauthenticated users to exploit the issue.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.15.3
What to do
Affects up to 4.15.3. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Favicon Generator (CLOSED): Does not validate files to be uploaded and does not have CSRF checksCVE-2024-7863 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server
Product
Favicon Generator (CLOSED)
Fixed in
2.1
What to do
Update Favicon Generator (CLOSED) to 2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2024Bit File Manager – 100% Free & Open Source File Manager and Code Editor for: Arbitrary file uploadsCVE-2024-7770 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 6.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted upload permissions by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for
Affected
up to 6.5.5
What to do
Affects up to 6.5.5. Update Bit File Manager – 100% Free & Open Source File Manager and Code Editor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2024Customizer Export/Import: Arbitrary file uploadsCVE-2024-7620 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.
Product
Customizer Export/Import
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Customizer Export/Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 7, 2024Ninja Forms - File Uploads: Stored Cross-Site ScriptingCVE-2024-1596 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms - File Uploads
Affected
up to 3.3.16
What to do
Affects up to 3.3.16. Update Ninja Forms - File Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ninjaforms.com ninjaforms.com
Sep 7, 2024Big File Uploads – Increase Maximum File Upload Size: Full Path DisclosureCVE-2024-8538 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This makes it possible for authenticated attackers, with author-level access and above, to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Big File Uploads – Increase Maximum File Upload Size
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Big File Uploads – Increase Maximum File Upload Size to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 28, 2024Funnelforms Free: Arbitrary file uploadsCVE-2024-6311 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' function in all versions up to, and including, 3.7.3.2. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Funnelforms Free
Affected
up to 3.7.3.2
What to do
Affects up to 3.7.3.2. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2024File Manager Pro: Arbitrary file uploadsCVE-2024-7559 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions up to, and including, 8.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
File Manager Pro
Affected
up to 8.3.7
What to do
Affects up to 8.3.7. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Aug 21, 2024AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Arbitrary file uploadsCVE-2024-7384 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive function in all versions up to, and including, 9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
Affected
up to 9.7.2
What to do
Affects up to 9.7.2. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 20, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Arbitrary JavaScript file uploadsCVE-2024-7775 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary JavaScript files to the affected site's server.
Product
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
Affected
2.0 to 2.13.9
What to do
Affects 2.0 to 2.13.9. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 20, 2024AdRotate Banner Manager – The only ad manager you'll need: Arbitrary file uploadsCVE-2022-1206 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AdRotate Banner Manager – The only ad manager you'll need plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension sanitization in the adrotate_insert_media() function in all versions up to, and including, 5.13.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.
Product
AdRotate Banner Manager – The only ad manager you'll need
Affected
up to 5.13.2
What to do
Affects up to 5.13.2. Update AdRotate Banner Manager – The only ad manager you'll need to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2024Bit Form Pro: Unrestricted Upload of File with Dangerous TypeCVE-2024-43249 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.This issue affects Bit Form Pro: from n/a through 2.6.4.
Product
Bit Form Pro
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Bit Form Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 17, 2024Metform Elementor Contact Form Builder: Arbitrary File UploadCVE-2023-0714 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious extension but ending with a benign extension, which may make remote code execution possible in some configurations.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2024WordPress File Upload: Stored Cross-Site ScriptingCVE-2024-7301 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.24.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WordPress File Upload
Affected
up to 4.24.8
What to do
Affects up to 4.24.8. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2024Slider and Carousel slider by Depicter: Arbitrary file uploadsCVE-2024-4389 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with contributor access or higher, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Slider and Carousel slider by Depicter
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Slider and Carousel slider by Depicter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2024BerqWP: Unrestricted Upload of File with Dangerous TypeCVE-2024-43160 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6.
Product
BerqWP
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update BerqWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024Media Library Assistant: Arbitrary file uploadsCVE-2024-6823 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Media Library Assistant
Affected
up to 3.18
What to do
Affects up to 3.18. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 7, 2024WordPress File Upload: Does not properly sanitize and escape certain parametersCVE-2024-6494 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.
Product
WordPress File Upload
Fixed in
4.24.8
What to do
Update WordPress File Upload to 4.24.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2024WordPress File Upload: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6651 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WordPress File Upload
Fixed in
4.24.8
What to do
Update WordPress File Upload to 4.24.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2024CRM Perks Forms: Arbitrary file uploadsCVE-2024-7484 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
CRM Perks Forms
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2024Blox Page Builder: Arbitrary file uploadsCVE-2024-6315 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Blox Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handleUploadFile' function in all versions up to, and including, 1.0.65. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Blox Page Builder
Affected
up to 1.0.65
What to do
Affects up to 1.0.65. Update Blox Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 3, 2024YayExtra – WooCommerce Extra Product Options: Arbitrary file uploadsCVE-2024-7257 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The YayExtra – WooCommerce Extra Product Options plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_upload_file function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
YayExtra – WooCommerce Extra Product Options
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update YayExtra – WooCommerce Extra Product Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 30, 2024Business Card: Does not prevent high privilege users like administrators from uploading malicious PHP filesCVE-2024-5807 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.
Product
Business Card
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Business Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 26, 2024Media.net Ads Manager: Arbitrary file uploadsCVE-2024-6431 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the 'sendMail' function in all versions up to, and including, 2.10.13. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is only exploitable if anyone has ever logged in through the API.
Product
Media.net Ads Manager
Affected
up to 2.10.13
What to do
Affects up to 2.10.13. Update Media.net Ads Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 23, 2024Social Auto Poster: Arbitrary file uploadsCVE-2024-6756 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. An attacker can use CVE-2024-6754 to exploit with subscriber-level access.
Product
Social Auto Poster
Affected
up to 5.3.14
What to do
Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 22, 2024Redux Framework: Unauthenticated JSON file uploadsCVE-2024-6828 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Color_Scheme_Import function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated attackers to upload JSON files, which can be used to conduct stored cross-site scripting attacks and, in some rare cases, when the wp_filesystem fails to initialize - to Remote Code Execution.
Product
Redux Framework
Affected
4.4.12 to 4.4.17
What to do
Affects 4.4.12 to 4.4.17. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org plugins.trac.wordpress.org
Jul 18, 2024Brizy – Page Builder: Arbitrary file uploadsCVE-2024-3242 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Version 2.4.44 prevents the upload of files ending in .sh and .php. Version 2.4.45 fully patches the issue.
Product
Brizy – Page Builder
Affected
up to 2.4.43
What to do
Affects up to 2.4.43. Update Brizy – Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2024简数采集器 (Keydatas): Arbitrary file uploadsCVE-2024-6220 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The 简数采集器 (Keydatas) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the keydatas_downloadImages function in all versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
简数采集器 (Keydatas)
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update 简数采集器 (Keydatas) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2024WordPress File Upload: Directory TraversalCVE-2024-5852 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'uploadpath' parameter of the wordpress_file_upload shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload limited files to arbitrary locations on the web server.
Product
WordPress File Upload
Affected
up to 4.24.7
What to do
Affects up to 4.24.7. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 15, 2024Insert or Embed Articulate Content into: Does not prevent authors from uploading arbitrary files to the siteCVE-2024-5630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
Product
Insert or Embed Articulate Content into
Fixed in
4.3000000024
What to do
Update Insert or Embed Articulate Content into to 4.3000000024 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-eMember: Does not validate files to be uploadedCVE-2024-5080 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server
Product
wp-eMember
Fixed in
10.6.6
What to do
Update wp-eMember to 10.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Realtyna Organic IDX: Unrestricted Upload of File with Dangerous TypeCVE-2024-38736 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Realtyna Realtyna Organic IDX plugin allows Code Injection.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.13.
Product
Realtyna Organic IDX
Affected
up to 4.14.13
What to do
Affects up to 4.14.13. Update Realtyna Organic IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.