Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

9,263 results · page 160 of 186

Apr 11, 2024Intagrate Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31929 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iain Poulson Intagrate Lite instagrate-to-wordpress.This issue affects Intagrate Lite: from n/a through <= 1.3.7.
Product
Intagrate Lite
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Intagrate Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Top Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31928 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Darko Top Bar allows Stored XSS.This issue affects Top Bar: from n/a through 3.0.5.
Product
Top Bar
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Top Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024WP Login and Logout Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31927 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aminur Islam WP Login and Logout Redirect allows Stored XSS.This issue affects WP Login and Logout Redirect: from n/a through 1.2.
Product
WP Login and Logout Redirect
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP Login and Logout Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Advanced Cron Manager – debug & control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31926 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BracketSpace Advanced Cron Manager – debug & control allows Stored XSS.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.2.
Product
Advanced Cron Manager – debug & control
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Advanced Cron Manager – debug & control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024F4 Improvements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31925 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FAKTOR VIER F4 Improvements allows Stored XSS.This issue affects F4 Improvements: from n/a through 1.8.0.
Product
F4 Improvements
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update F4 Improvements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Popup Like box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31387 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Popup LikeBox Team Popup Like box allows Stored XSS.This issue affects Popup Like box: from n/a through 3.7.2.
Product
Popup Like box
Affected
up to 3.7.2
What to do
Affects up to 3.7.2. Update Popup Like box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024bunny.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31361 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.Net allows Stored XSS.This issue affects bunny.Net: from n/a through 2.0.1.
Product
bunny.Net
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update bunny.Net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Search Keyword Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32080 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Pelton Search Keyword Redirect allows Stored XSS.This issue affects Search Keyword Redirect: from n/a through 1.0.
Product
Search Keyword Redirect
Affected
up to 1.0
What to do
Affects up to 1.0. Update Search Keyword Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27992 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper Link Whisper Free allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.6.8.
Product
Link Whisper Free
Affected
up to 0.6.8
What to do
Affects up to 0.6.8. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024SupportCandy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SupportCandy allows Stored XSS.This issue affects SupportCandy: from n/a through 3.2.3.
Product
SupportCandy
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024The Moneytizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27990 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Moneytizer allows Stored XSS.This issue affects The Moneytizer: from n/a through 9.5.20.
Product
The Moneytizer
Affected
up to 9.5.20
What to do
Affects up to 9.5.20. Update The Moneytizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WP Responsive Tabs horizontal vertical and accordion Tabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27989 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs allows Stored XSS.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs: from n/a through 1.1.17.
Product
WP Responsive Tabs horizontal vertical and accordion Tabs
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update WP Responsive Tabs horizontal vertical and accordion Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WEN Responsive Columns: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2.
Product
WEN Responsive Columns
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WEN Responsive Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Free Downloads WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Enhanced Free Downloads WooCommerce allows Stored XSS.This issue affects Free Downloads WooCommerce: from n/a through 3.5.8.2.
Product
Free Downloads WooCommerce
Affected
up to 3.5.8.2
What to do
Affects up to 3.5.8.2. Update Free Downloads WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27966 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 8.2.2.
Product
Quiz And Survey Master
Affected
up to 8.2.2
What to do
Affects up to 8.2.2. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Import any XML or CSV File to: Cross-Site Request Forgery (CSRF)CVE-2024-31939 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Import any XML or CSV File to WordPress.This issue affects Import any XML or CSV File to WordPress: from n/a through 3.7.3.
Product
Import any XML or CSV File to
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update Import any XML or CSV File to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024User Activity Log: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31356 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User Activity Log: from n/a through 1.8.
Product
User Activity Log
Affected
up to 1.8
What to do
Affects up to 1.8. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Slideshow Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31355 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
Product
Slideshow Gallery
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Media Library Folders: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-31287 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8.
Product
Media Library Folders
Affected
up to 8.1.8
What to do
Affects up to 8.1.8. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WP Poll Maker: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-31240 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in InfoTheme WP Poll Maker.This issue affects WP Poll Maker: from n/a through 3.1.
Product
WP Poll Maker
Affected
up to 3.1
What to do
Affects up to 3.1. Update WP Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'sCVE-2024-3020 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: SQL InjectionCVE-2024-2342 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.7.7
What to do
Affects up to 1.6.7.7. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: SQL InjectionCVE-2024-2341 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.7.7
What to do
Affects up to 1.6.7.7. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Template Kit – Import: Stored Cross-Site ScriptingCVE-2024-2334 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Template Kit – Import
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Template Kit – Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024EnvíaloSimple: Email Marketing y Newsletters: Cross-Site Request ForgeryCVE-2024-2125 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the gallery_add function. This makes it possible for unauthenticated attackers to upload malicious files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The Cross-Site Request Forgery was patched in 2.4, however, nothing was done about the ability to upload arbitrary files.
Product
EnvíaloSimple: Email Marketing y Newsletters
Affected
up to 2.3
What to do
Affects up to 2.3. Update EnvíaloSimple: Email Marketing y Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Simple Job Board: PHP Object InjectionCVE-2024-1813 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitted job application is viewed.
Product
Simple Job Board
Affected
up to 2.11.0
What to do
Affects up to 2.11.0. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024AIKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31370 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeIsAwesome AIKit aikit-wordpress-ai-writing-assistant-using-gpt3.This issue affects AIKit: from n/a through <= 4.14.1.
Product
AIKit
Affected
up to 4.14.1
What to do
Affects up to 4.14.1. Update AIKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Post Type Builder (PTB): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31365 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Post Type Builder (PTB) allows Reflected XSS.This issue affects Post Type Builder (PTB): from n/a before 2.1.1.
Product
Post Type Builder (PTB)
Fixed in
2.1.1
What to do
Update Post Type Builder (PTB) to 2.1.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 8, 2024Ultimate Store Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31357 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.5.2.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024MailMunch – Grow your Email List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailMunch – Grow your Email List allows Stored XSS.This issue affects MailMunch – Grow your Email List: from n/a through 3.1.6.
Product
MailMunch – Grow your Email List
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update MailMunch – Grow your Email List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials allows Stored XSS.This issue affects Testimonials: from n/a through 3.0.5.
Product
Testimonials
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Gradient Text Widget for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31346 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksmarket Gradient Text Widget for Elementor allows Stored XSS.This issue affects Gradient Text Widget for Elementor: from n/a through 1.0.1.
Product
Gradient Text Widget for Elementor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Gradient Text Widget for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Easy Login Styler – White Label Admin Login Page for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31344 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phpbits Creative Studio Easy Login Styler – White Label Admin Login Page for WordPress allows Stored XSS.This issue affects Easy Login Styler – White Label Admin Login Page for WordPress: from n/a through 1.0.6.
Product
Easy Login Styler – White Label Admin Login Page for
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Easy Login Styler – White Label Admin Login Page for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024WP Import Export Lite: Deserialization of Untrusted DataCVE-2024-31308 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.
Product
WP Import Export Lite
Affected
up to 3.9.26
What to do
Affects up to 3.9.26. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Essential Blocks for Gutenberg: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31306 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Stored XSS.This issue affects Essential Blocks for Gutenberg: from n/a through 4.5.3.
Product
Essential Blocks for Gutenberg
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Import XML and RSS Feeds: Unrestricted Upload of File with Dangerous TypeCVE-2024-31292 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unrestricted Upload of File with Dangerous Type vulnerability in Moove Agency Import XML and RSS Feeds.This issue affects Import XML and RSS Feeds: from n/a through 2.1.5.
Product
Import XML and RSS Feeds
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Import XML and RSS Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Edwiser Bridge: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31260 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WisdmLabs Edwiser Bridge.This issue affects Edwiser Bridge: from n/a through 3.0.2.
Product
Edwiser Bridge
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Form to Chat App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31258 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.Company Form to Chat App allows Stored XSS.This issue affects Form to Chat App: from n/a through 1.1.6.
Product
Form to Chat App
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Form to Chat App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Formsite | Embed online forms to collect orders, registrations, leads, and surveys: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formsite Formsite | Embed online forms to collect orders, registrations, leads, and surveys allows Stored XSS.This issue affects Formsite | Embed online forms to collect orders, registrations, leads, and surveys: from n/a through 1.6.
Product
Formsite | Embed online forms to collect orders, registrations, leads, and surveys
Affected
up to 1.6
What to do
Affects up to 1.6. Update Formsite | Embed online forms to collect orders, registrations, leads, and surveys to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024WebinarPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31256 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebinarPress allows Reflected XSS.This issue affects WebinarPress: from n/a through 1.33.10.
Product
WebinarPress
Affected
up to 1.33.10
What to do
Affects up to 1.33.10. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31255 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts allows Reflected XSS.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.
Product
ELEX WooCommerce Dynamic Pricing and Discounts
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024LearnPress Export Import: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31241 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress LearnPress Export Import.This issue affects LearnPress Export Import: from n/a through 4.0.3.
Product
LearnPress Export Import
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update LearnPress Export Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31236 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.3.93.
Product
Royal Elementor Addons
Affected
up to 1.3.93
What to do
Affects up to 1.3.93. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024REHub Framework: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31234 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam REHub Framework.This issue affects REHub Framework: from n/a before 19.6.2.
Product
REHub Framework
Fixed in
19.6.2
What to do
Update REHub Framework to 19.6.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Rehub: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31233 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam Rehub.This issue affects Rehub: from n/a through 19.6.1.
Product
Rehub
Affected
up to 19.6.1
What to do
Affects up to 19.6.1. Update Rehub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2024BoldGrid Easy SEO – Simple and Effective SEO: Information ExposureCVE-2024-2950 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.14 via meta information (og:description) This makes it possible for unauthenticated attackers to view the first 130 characters of a password protected post which can contain sensitive information.
Product
BoldGrid Easy SEO – Simple and Effective SEO
Affected
up to 1.6.14
What to do
Affects up to 1.6.14. Update BoldGrid Easy SEO – Simple and Effective SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 3, 2024Canto: Improper Control of Generation of Code ('Code Injection')CVE-2024-25096 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.
Product
Canto
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Canto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 3, 2024Cwicly: Improper Control of Generation of Code ('Code Injection')CVE-2024-24707 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Cwicly Builder, SL. Cwicly allows Code Injection.This issue affects Cwicly: from n/a through 1.4.0.2.
Product
Cwicly
Affected
up to 1.4.0.2
What to do
Affects up to 1.4.0.2. Update Cwicly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com snicco.io
Apr 3, 2024VideoWhisper Live Streaming Integration: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2023-25699 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integration allows OS Command Injection.This issue affects VideoWhisper Live Streaming Integration: from n/a through 5.5.15.
Product
VideoWhisper Live Streaming Integration
Affected
up to 5.5.15
What to do
Affects up to 5.5.15. Update VideoWhisper Live Streaming Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 3, 2024Breakdance: : Improper Control of Generation of Code ('Code Injection')CVE-2024-31390 · WordPress plugins & themes · reported by PatchstackCritical 9.9
: Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a through 1.7.2.
Product
Breakdance
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Breakdance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.