Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

349new WordPress flaws this week

393,576entries in the database

8,946 results · page 164 of 179

Jan 31, 2024Posts List Designer by Category – List Category Posts Or Recent Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-23502 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in InfornWeb Posts List Designer by Category – List Category Posts Or Recent Posts allows Stored XSS.This issue affects Posts List Designer by Category – List Category Posts Or Recent Posts: from n/a through 3.3.2.
Product
Posts List Designer by Category – List Category Posts Or Recent Posts
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Posts List Designer by Category – List Category Posts Or Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024InstaWP Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-23507 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
Product
InstaWP Connect
Affected
up to 0.1.0.9
What to do
Affects up to 0.1.0.9. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 29, 2024The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication.CVE-2024-0212 · WordPress plugins & themes · reported by cna@cloudflare.comHigh 8.1
The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.
Fixed in
4.12.3
What to do
Update the plugin to 4.12.3 or newer.
Full record and what to do →NVD record github.com github.com
Jan 26, 2024Delhivery Logistics Courier: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-22283 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delhivery Delhivery Logistics Courier.This issue affects Delhivery Logistics Courier: from n/a through 1.0.107.
Product
Delhivery Logistics Courier
Affected
up to 1.0.107
What to do
Affects up to 1.0.107. Update Delhivery Logistics Courier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 26, 2024PDF Invoices & Packing Slips for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-22147 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce.This issue affects PDF Invoices & Packing Slips for WooCommerce: from n/a through 3.7.5.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 3.7.5
What to do
Affects up to 3.7.5. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 22, 2024WP User Profile Avatar: Does not properly check for authorisationCVE-2023-6384 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar
Product
WP User Profile Avatar
Fixed in
1.0.1
What to do
Update WP User Profile Avatar to 1.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2024Track The Click: Does not properly sanitize query parameters to the stats REST endpoint before using them in a database queryCVE-2023-5041 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
Product
Track The Click
Fixed in
0.3.12
What to do
Update Track The Click to 0.3.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Do not properly sanitise and escape a parameter before outputting it back in pagesCVE-2024-0233 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EventON WordPress plugin before 4.5.5, EventON
Fixed in
4.5.5
What to do
Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WP Customer Area: Does not properly validates user capabilities in some of its AJAX actionsCVE-2023-6824 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.
Product
WP Customer Area
Fixed in
8.2.1
What to do
Update WP Customer Area to 8.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WP Customer Area: Does not properly validate users capabilities in some of its AJAX actionsCVE-2023-6741 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.
Product
WP Customer Area
Fixed in
8.2.1
What to do
Update WP Customer Area to 8.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Newsletters: Does not properly escape user-controlled parametersCVE-2023-4797 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.
Product
Newsletters
Fixed in
4.9.3
What to do
Update Newsletters to 4.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024All in One B2B for WooCommerce: Does not properly validate parametersCVE-2023-4703 · WordPress plugins & themes · reported by WPScanHigh 7.5
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation.
Product
All in One B2B for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update All in One B2B for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
WordPress Database Administrator
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024POST SMTP Mailer: Does not have proper CSRF checks in some AJAX actionsCVE-2023-3178 · WordPress plugins & themes · reported by WPScanMedium 4.3
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.
Product
POST SMTP Mailer
Fixed in
2.5.7
What to do
Update POST SMTP Mailer to 2.5.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Contact Form by WD: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2655 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Contact Form by WD
Affected
up to 1.13.23
What to do
Affects up to 1.13.23. Update Contact Form by WD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024GiveWP: Does not properly escape user input before it reaches SQL queriesCVE-2023-0224 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks
Product
GiveWP
Fixed in
2.24.1
What to do
Update GiveWP to 2.24.1 or newer.
Full record and what to do →NVD record givewp.com wpscan.com
Jan 16, 2024Slide Anything: Does not properly sanitize or escape the slide title before outputting it in the admin pagesCVE-2022-2413 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfiltered_html capability is disabled.
Product
Slide Anything
Fixed in
2.3.47
What to do
Update Slide Anything to 2.3.47 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WooCommerce: Does not have proper authorisation checkCVE-2022-0775 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment
Product
WooCommerce
Fixed in
6.2.1
What to do
Update WooCommerce to 6.2.1 or newer.
Full record and what to do →NVD record developer.woocommerce.com plugins.trac.wordpress.org
Jan 16, 2024ark-commenteditor: Does not properly sanitise or encode the commentsCVE-2021-4227 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
Product
ark-commenteditor
Affected
up to 2.15.6
What to do
Affects up to 2.15.6. Update ark-commenteditor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg: Does not properly secure some of its AJAX actionsCVE-2023-6843 · WordPress plugins & themes · reported by WPScanMedium 4.3
The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 does not properly secure some of its AJAX actions, allowing any logged-in users to modify its settings.
Product
easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg
Fixed in
2.4.7
What to do
Update easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg to 2.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024POST SMTP Mailer: Does not properly sanitise and escape several parameters before using them in SQL statementsCVE-2023-6620 · WordPress plugins & themes · reported by WPScanHigh 7.2
The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin.
Product
POST SMTP Mailer
Fixed in
2.8.7
What to do
Update POST SMTP Mailer to 2.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024WP Custom Widget area: Does not properly apply capability and nonce checks on any of its AJAX action callback functionsCVE-2023-6066 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.
Product
WP Custom Widget area
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update WP Custom Widget area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 12, 2024Profile Builder Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22142 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This issue affects Profile Builder Pro: from n/a through 3.10.0.
Product
Profile Builder Pro
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update Profile Builder Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 12, 2024Constant Contact Forms by MailMunch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22137 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch Constant Contact Forms by MailMunch allows Stored XSS.This issue affects Constant Contact Forms by MailMunch: from n/a through 2.0.11.
Product
Constant Contact Forms by MailMunch
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Constant Contact Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 12, 2024WordPress Quiz Maker Plugin prior to 6.5.0.6: Improper input validationCVE-2024-22027 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services.
Product
WordPress Quiz Maker Plugin prior to 6.5.0.6
Fixed in
6.5.0.6
What to do
Update WordPress Quiz Maker Plugin prior to 6.5.0.6 to 6.5.0.6 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 8, 2024pTypeConverter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52201 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brian D. Goad pTypeConverter.This issue affects pTypeConverter: from n/a through 0.2.8.1.
Product
pTypeConverter
Affected
up to 0.2.8.1
What to do
Affects up to 0.2.8.1. Update pTypeConverter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Private Google Calendars: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52198 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michiel van Eerd Private Google Calendars allows Stored XSS.This issue affects Private Google Calendars: from n/a through 20231125.
Product
Private Google Calendars
Affected
up to 20231125
What to do
Affects up to 20231125. Update Private Google Calendars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Ads Invalid Click Protection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52197 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XSS.This issue affects Ads Invalid Click Protection: from n/a through 1.0.
Product
Ads Invalid Click Protection
Affected
up to 1.0
What to do
Affects up to 1.0. Update Ads Invalid Click Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024CPT Bootstrap Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52196 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phil Ewels CPT Bootstrap Carousel allows Reflected XSS.This issue affects CPT Bootstrap Carousel: from n/a through 1.12.
Product
CPT Bootstrap Carousel
Affected
up to 1.12
What to do
Affects up to 1.12. Update CPT Bootstrap Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Events Shortcodes For The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52142 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cool Plugins Events Shortcodes For The Events Calendar.This issue affects Events Shortcodes For The Events Calendar: from n/a through 2.3.1.
Product
Events Shortcodes For The Events Calendar
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Events Shortcodes For The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Rate Star Review – AJAX Reviews for Content, with Star Ratings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52213 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper Rate Star Review – AJAX Reviews for Content, with Star Ratings allows Reflected XSS.This issue affects Rate Star Review – AJAX Reviews for Content, with Star Ratings: from n/a through 1.5.1.
Product
Rate Star Review – AJAX Reviews for Content, with Star Ratings
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Rate Star Review – AJAX Reviews for Content, with Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Randomize: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52204 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Javik Randomize.This issue affects Randomize: from n/a through 1.4.3.
Product
Randomize
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Randomize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024cformsII: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52203 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliver Seidel, Bastian Germann cformsII allows Stored XSS.This issue affects cformsII: from n/a through 15.0.5.
Product
cformsII
Affected
up to 15.0.5
What to do
Affects up to 15.0.5. Update cformsII to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024WP Go Maps (formerly WP Google Maps): Does not properly protect most of its REST API routesCVE-2023-6627 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site.
Product
WP Go Maps (formerly WP Google Maps)
Fixed in
9.0.28
What to do
Update WP Go Maps (formerly WP Google Maps) to 9.0.28 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6141 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.
Product
Essential Real Estate
Fixed in
4.4.0
What to do
Update Essential Real Estate to 4.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6139 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.
Product
Essential Real Estate
Fixed in
4.4.0
What to do
Update Essential Real Estate to 4.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Duplicator: Does not properly escape valuesCVE-2018-25095 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
Product
Duplicator
Fixed in
1.3.0
What to do
Update Duplicator to 1.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52215 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UkrSolution Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce: from n/a through 1.5.1.
Product
Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-21747 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: from n/a through 1.12.8.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Affected
up to 1.12.8
What to do
Affects up to 1.12.8. Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Laybuy Payment Extension for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-21745 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laybuy Laybuy Payment Extension for WooCommerce allows Stored XSS.This issue affects Laybuy Payment Extension for WooCommerce: from n/a through 5.3.9.
Product
Laybuy Payment Extension for WooCommerce
Affected
up to 5.3.9
What to do
Affects up to 5.3.9. Update Laybuy Payment Extension for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Mapster WP Maps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-21744 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapster Technology Inc. Mapster WP Maps allows Stored XSS.This issue affects Mapster WP Maps: from n/a through 1.2.38.
Product
Mapster WP Maps
Affected
up to 1.2.38
What to do
Affects up to 1.2.38. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024iframe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52125 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8.
Product
iframe
Affected
up to 4.8
What to do
Affects up to 4.8. Update iframe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024WP Tabs – Responsive Tabs Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52124 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for WordPress allows Stored XSS.This issue affects WP Tabs – Responsive Tabs Plugin for WordPress: from n/a through 2.2.0.
Product
WP Tabs – Responsive Tabs Plugin for
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update WP Tabs – Responsive Tabs Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024WP Affiliate Disclosure: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52178 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS.This issue affects WP Affiliate Disclosure: from n/a through 1.2.7.
Product
WP Affiliate Disclosure
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WP Affiliate Disclosure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Most And Least Read Posts Widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52133 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.16.
Product
Most And Least Read Posts Widget
Affected
up to 2.5.16
What to do
Affects up to 2.5.16. Update Most And Least Read Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023WP Adminify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52132 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.
Product
WP Adminify
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Page Generator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52131 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Zinc Page Generator.This issue affects Page Generator: from n/a through 1.7.1.
Product
Page Generator
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Page Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Fluent Support – WordPress Helpdesk and Customer Support Ticket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51547 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin: from n/a through 1.7.6.
Product
Fluent Support – WordPress Helpdesk and Customer Support Ticket
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Fluent Support – WordPress Helpdesk and Customer Support Ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Checkout Mestres WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51469 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Checkout Mestres WP: from n/a through 7.1.9.6.
Product
Checkout Mestres WP
Affected
up to 7.1.9.6
What to do
Affects up to 7.1.9.6. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51423 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
Product
Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Affected
up to 3.05.0
What to do
Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.