Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

279new WordPress flaws this week

393,576entries in the database

8,946 results · page 166 of 179

Dec 28, 2023WP Crowdfunding: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50859 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6.
Product
WP Crowdfunding
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50857 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.
Product
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – CustCVE-2023-50856 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits.This issue affects Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits: from n/a through 2.14.3.
Affected
up to 2.14.3
What to do
Affects up to 2.14.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023HTML Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50836 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28.
Product
HTML Forms
Affected
up to 1.3.28
What to do
Affects up to 1.3.28. Update HTML Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Uncode - Creative & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51501 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Uncode - Creative & WooCommerce WordPress Theme: from n/a through 2.8.6.
Product
Uncode - Creative & WooCommerce
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Uncode - Creative & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023WordPress Infinite Scroll – Ajax Load More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50874 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1.
Product
WordPress Infinite Scroll – Ajax Load More
Affected
up to 6.1.0.1
What to do
Affects up to 6.1.0.1. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5674 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Mail Log: Does not properly validate file extensions uploading files to attach to emailsCVE-2023-5673 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Mail Log: Does not properly validate file path parametersCVE-2023-5672 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5645 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2023WooCommerce Menu Extension: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50834 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech WooCommerce Menu Extension allows Stored XSS.This issue affects WooCommerce Menu Extension: from n/a through 1.6.2.
Product
WooCommerce Menu Extension
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update WooCommerce Menu Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Colibri Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50833 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239.
Product
Colibri Page Builder
Affected
up to 1.0.239
What to do
Affects up to 1.0.239. Update Colibri Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Multi Step Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50832 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mondula GmbH Multi Step Form allows Stored XSS.This issue affects Multi Step Form: from n/a through 1.7.13.
Product
Multi Step Form
Affected
up to 1.7.13
What to do
Affects up to 1.7.13. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023CURCY – Multi Currency for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50831 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY – Multi Currency for WooCommerce allows Stored XSS.This issue affects CURCY – Multi Currency for WooCommerce: from n/a through 2.2.0.
Product
CURCY – Multi Currency for WooCommerce
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update CURCY – Multi Currency for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Seos Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50830 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seosbg Seos Contact Form allows Stored XSS.This issue affects Seos Contact Form: from n/a through 1.8.0.
Product
Seos Contact Form
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Seos Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Loan Repayment Calculator and Application Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50829 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aerin Loan Repayment Calculator and Application Form allows Stored XSS.This issue affects Loan Repayment Calculator and Application Form: from n/a through 2.9.3.
Product
Loan Repayment Calculator and Application Form
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Loan Repayment Calculator and Application Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Ultimate Dashboard – Custom WordPress Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50828 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ultimate Dashboard – Custom WordPress Dashboard allows Stored XSS.This issue affects Ultimate Dashboard – Custom WordPress Dashboard: from n/a through 3.7.11.
Product
Ultimate Dashboard – Custom WordPress Dashboard
Affected
up to 3.7.11
What to do
Affects up to 3.7.11. Update Ultimate Dashboard – Custom WordPress Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Accredible Certificates & Open Badges: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50827 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Accredible Accredible Certificates & Open Badges allows Stored XSS.This issue affects Accredible Certificates & Open Badges: from n/a through 1.4.8.
Product
Accredible Certificates & Open Badges
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Accredible Certificates & Open Badges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Menu Image, Icons made easy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50826 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Freshlight Lab Menu Image, Icons made easy allows Stored XSS.This issue affects Menu Image, Icons made easy: from n/a through 3.10.
Product
Menu Image, Icons made easy
Affected
up to 3.10
What to do
Affects up to 3.10. Update Menu Image, Icons made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023iframe Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50825 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terrier Tenacity iframe Shortcode allows Stored XSS.This issue affects iframe Shortcode: from n/a through 2.0.
Product
iframe Shortcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update iframe Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Insert or Embed Articulate Content into: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50824 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Batt Insert or Embed Articulate Content into WordPress allows Stored XSS.This issue affects Insert or Embed Articulate Content into WordPress: from n/a through 4.3000000021.
Product
Insert or Embed Articulate Content into
Affected
up to 4.3000000021
What to do
Affects up to 4.3000000021. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023CSS & JavaScript Toolbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50823 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wipeout Media CSS & JavaScript Toolbox allows Stored XSS.This issue affects CSS & JavaScript Toolbox: from n/a through 11.7.
Product
CSS & JavaScript Toolbox
Affected
up to 11.7
What to do
Affects up to 11.7. Update CSS & JavaScript Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Currency Converter Widget – Exchange Rates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50822 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Currency.Wiki Currency Converter Widget – Exchange Rates allows Stored XSS.This issue affects Currency Converter Widget – Exchange Rates: from n/a through 3.0.2.
Product
Currency Converter Widget – Exchange Rates
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Currency Converter Widget – Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Simple Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50377 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AB-WP Simple Counter allows Stored XSS.This issue affects Simple Counter: from n/a through 1.0.2.
Product
Simple Counter
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Simple Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WP Edit Username: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47527 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sajjad Hossain Sagor WP Edit Username allows Stored XSS.This issue affects WP Edit Username: from n/a through 1.0.5.
Product
WP Edit Username
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP Edit Username to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Event Monster – Event Management, Tickets Booking, Upcoming Event: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47525 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through 1.3.2.
Product
Event Monster – Event Management, Tickets Booking, Upcoming Event
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Adifier - Classified Ads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49752 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads WordPress Theme.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
Product
Adifier - Classified Ads
Fixed in
3.1.4
What to do
Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023MSync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49166 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0.
Product
MSync
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update MSync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Bravo Translate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49161 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Guelben Bravo Translate.This issue affects Bravo Translate: from n/a through 1.2.
Product
Bravo Translate
Affected
up to 1.2
What to do
Affects up to 1.2. Update Bravo Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Houzez - Real Estate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-29432 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.
Product
Houzez - Real Estate
Fixed in
2.8.3
What to do
Update Houzez - Real Estate to 2.8.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Contact Form to DB by BestWebSoft – Messages Database Plugin For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-29096 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.0.
Product
Contact Form to DB by BestWebSoft – Messages Database Plugin For
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Advanced Page Visit Counter – Most Wanted Analytics Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28788 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 6.4.2.
Product
Advanced Page Visit Counter – Most Wanted Analytics Plugin for
Affected
up to 6.4.2
What to do
Affects up to 6.4.2. Update Advanced Page Visit Counter – Most Wanted Analytics Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Slideshow Gallery LITE: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28491 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6.
Product
Slideshow Gallery LITE
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Slideshow Gallery LITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-26525 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.12.
Product
Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Affected
up to 3.7.12
What to do
Affects up to 3.7.12. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023BSK Forms Blacklist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30872 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Forms Blacklist: from n/a through 3.6.2.
Product
BSK Forms Blacklist
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023CM Popup Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30750 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This issue affects CM Popup Plugin for WordPress: from n/a through 1.5.10.
Product
CM Popup Plugin for
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update CM Popup Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Ultimate Addons for Contact Form 7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30495 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.
Product
Ultimate Addons for Contact Form 7
Affected
up to 3.1.23
What to do
Affects up to 3.1.23. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Soledad – Multipurpose, Newspaper, Blog & WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49825 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Product
Soledad – Multipurpose, Newspaper, Blog & WooCommerce
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Soledad – Multipurpose, Newspaper, Blog & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Sayfa Sayac: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49776 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6.
Product
Sayfa Sayac
Affected
up to 2.6
What to do
Affects up to 2.6. Update Sayfa Sayac to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023WooPayments – Fully Integrated Solution Built and Supported by Woo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-35915 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.
Product
WooPayments – Fully Integrated Solution Built and Supported by Woo
Affected
up to 5.9.0
What to do
Affects up to 5.9.0. Update WooPayments – Fully Integrated Solution Built and Supported by Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023AutomateWoo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33330 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.50.
Product
AutomateWoo
Affected
up to 4.9.50
What to do
Affects up to 4.9.50. Update AutomateWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023SEO Change Monitor – Track Website Changes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33209 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track Website Changes.This issue affects SEO Change Monitor – Track Website Changes: from n/a through 1.2.
Product
SEO Change Monitor – Track Website Changes
Affected
up to 1.2
What to do
Affects up to 1.2. Update SEO Change Monitor – Track Website Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023AutomateWoo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32743 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.1.
Product
AutomateWoo
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update AutomateWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32128 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adastra Crypto Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free.This issue affects Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free: from n/a through 2.2.7.
Product
Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Easy Bet: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-31092 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Foxskav Easy Bet.This issue affects Easy Bet: from n/a through 1.0.2.
Product
Easy Bet
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Easy Bet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47852 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.
Product
Link Whisper Free
Affected
up to 0.6.5
What to do
Affects up to 0.6.5. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023HUSKY – Products Filter for WooCommerce Professional: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-40010 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY – Products Filter for WooCommerce Professional.This issue affects HUSKY – Products Filter for WooCommerce Professional: from n/a through 1.3.4.2.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.3.4.2
What to do
Affects up to 1.3.4.2. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Subscribe to Category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32590 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category.This issue affects Subscribe to Category: from n/a through 2.7.4.
Product
Subscribe to Category
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update Subscribe to Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023iPages Flipbook For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47236 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum iPages Flipbook For WordPress.This issue affects iPages Flipbook For WordPress: from n/a through 1.4.8.
Product
iPages Flipbook For
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update iPages Flipbook For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-38519 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance.This issue affects MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: from n/a through 4.4.3.3.
Product
MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Affected
up to 4.4.3.3
What to do
Affects up to 4.4.3.3. Update MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.