Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,019 results · page 17 of 21

Mar 28, 2024Fusion Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-39309 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
Product
Fusion Builder
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024DecaLog: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30245 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pierre Lannoy DecaLog decalog.This issue affects DecaLog: from n/a through <= 3.9.0.
Product
DecaLog
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update DecaLog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Church Admin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30244 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.
Product
Church Admin
Affected
up to 4.0.27
What to do
Affects up to 4.0.27. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024WordPress Tooltips: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30243 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tomas WordPress Tooltips.This issue affects WordPress Tooltips: from n/a before 9.4.5.
Product
WordPress Tooltips
Fixed in
9.4.5
What to do
Update WordPress Tooltips to 9.4.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Contact Form to Any API: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30242 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions Contact Form to Any API.This issue affects Contact Form to Any API: from n/a through 1.1.8.
Product
Contact Form to Any API
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024ProfileGrid: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30241 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.1.
Product
ProfileGrid
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Calendarista: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30240 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Typps Calendarista.This issue affects Calendarista: from n/a through 15.5.7.
Product
Calendarista
Affected
up to 15.5.7
What to do
Affects up to 15.5.7. Update Calendarista to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Zoho Campaigns: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30239 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.6.
Product
Zoho Campaigns
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Zoho Campaigns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Slider by Supsystic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30237 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Supsystic Slider by Supsystic.This issue affects Slider by Supsystic: from n/a through 1.8.10.
Product
Slider by Supsystic
Affected
up to 1.8.10
What to do
Affects up to 1.8.10. Update Slider by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Contest Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30236 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 21.3.4.
Product
Contest Gallery
Affected
up to 21.3.4
What to do
Affects up to 21.3.4. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Contest Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30238 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 21.3.2.
Product
Contest Gallery
Affected
up to 21.3.2
What to do
Affects up to 21.3.2. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28787 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.
Product
Quiz And Survey Master
Affected
up to 8.1.4
What to do
Affects up to 8.1.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-23991 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdevelop / Oplugins Booking Calendar allows SQL Injection.This issue affects Booking Calendar: from n/a through 9.4.3.
Product
Booking Calendar
Affected
up to 9.4.3
What to do
Affects up to 9.4.3. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Automatic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-27956 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
Product
Automatic
Affected
up to 3.92.0
What to do
Affects up to 3.92.0. Update Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024postMash – custom post order: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25927 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Joel Starnes postMash – custom post order.This issue affects postMash – custom post order: from n/a through 1.2.0.
Product
postMash – custom post order
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update postMash – custom post order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024MoveTo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25910 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.
Product
MoveTo
Affected
up to 6.2
What to do
Affects up to 6.2. Update MoveTo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Malware Scanner: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25902 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Scanner: from n/a through 4.7.2.
Product
Malware Scanner
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update Malware Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024SP Project & Document Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-24868 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69.
Product
SP Project & Document Manager
Affected
up to 4.69
What to do
Affects up to 4.69. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 23, 2024Sitepact: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25928 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sitepact.This issue affects Sitepact: from n/a through 1.0.5.
Product
Sitepact
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Sitepact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024InstaWP Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-23507 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
Product
InstaWP Connect
Affected
up to 0.1.0.9
What to do
Affects up to 0.1.0.9. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 26, 2024Delhivery Logistics Courier: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-22283 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delhivery Delhivery Logistics Courier.This issue affects Delhivery Logistics Courier: from n/a through 1.0.107.
Product
Delhivery Logistics Courier
Affected
up to 1.0.107
What to do
Affects up to 1.0.107. Update Delhivery Logistics Courier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 26, 2024PDF Invoices & Packing Slips for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-22147 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce.This issue affects PDF Invoices & Packing Slips for WooCommerce: from n/a through 3.7.5.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 3.7.5
What to do
Affects up to 3.7.5. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 11, 2024LearnPress: Command InjectionCVE-2023-6634 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution.
Product
LearnPress
Affected
up to 4.2.5.7
What to do
Affects up to 4.2.5.7. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2024pTypeConverter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52201 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brian D. Goad pTypeConverter.This issue affects pTypeConverter: from n/a through 0.2.8.1.
Product
pTypeConverter
Affected
up to 0.2.8.1
What to do
Affects up to 0.2.8.1. Update pTypeConverter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Events Shortcodes For The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52142 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cool Plugins Events Shortcodes For The Events Calendar.This issue affects Events Shortcodes For The Events Calendar: from n/a through 2.3.1.
Product
Events Shortcodes For The Events Calendar
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Events Shortcodes For The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Randomize: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52204 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Javik Randomize.This issue affects Randomize: from n/a through 1.4.3.
Product
Randomize
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Randomize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52215 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UkrSolution Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce: from n/a through 1.5.1.
Product
Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-21747 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: from n/a through 1.12.8.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Affected
up to 1.12.8
What to do
Affects up to 1.12.8. Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Most And Least Read Posts Widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52133 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.16.
Product
Most And Least Read Posts Widget
Affected
up to 2.5.16
What to do
Affects up to 2.5.16. Update Most And Least Read Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023WP Adminify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52132 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.
Product
WP Adminify
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Page Generator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52131 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Zinc Page Generator.This issue affects Page Generator: from n/a through 1.7.1.
Product
Page Generator
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Page Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Fluent Support – WordPress Helpdesk and Customer Support Ticket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51547 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin: from n/a through 1.7.6.
Product
Fluent Support – WordPress Helpdesk and Customer Support Ticket
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Fluent Support – WordPress Helpdesk and Customer Support Ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Checkout Mestres WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51469 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Checkout Mestres WP: from n/a through 7.1.9.6.
Product
Checkout Mestres WP
Affected
up to 7.1.9.6
What to do
Affects up to 7.1.9.6. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51423 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
Product
Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Affected
up to 3.05.0
What to do
Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023GEO my: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52134 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This issue affects GEO my WordPress: from n/a through 4.0.2.
Product
GEO my
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update GEO my to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Recipe Maker For Your Food Blog from Zip Recipes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52180 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes.This issue affects Recipe Maker For Your Food Blog from Zip Recipes: from n/a through 8.1.0.
Product
Recipe Maker For Your Food Blog from Zip Recipes
Affected
up to 8.1.0
What to do
Affects up to 8.1.0. Update Recipe Maker For Your Food Blog from Zip Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Login Lockdown – Protect Login Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50837 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form.This issue affects Login Lockdown – Protect Login Form: from n/a through 2.06.
Product
Login Lockdown – Protect Login Form
Affected
up to 2.06
What to do
Affects up to 2.06. Update Login Lockdown – Protect Login Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023WS Form LITE – Drag & Drop Contact Form Builder for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52135 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress.This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170.
Product
WS Form LITE – Drag & Drop Contact Form Builder for
Affected
up to 1.9.170
What to do
Affects up to 1.9.170. Update WS Form LITE – Drag & Drop Contact Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023JS Help Desk – Best Help Desk & Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50839 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023NEX-Forms – Ultimate Form Builder – Contact forms and much more: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50838 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more.This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: from n/a through 8.5.5.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.5
What to do
Affects up to 8.5.5. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Welcart e-Commerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50847 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Collne Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.3.
Product
Welcart e-Commerce
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50846 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.5.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.2.4.5
What to do
Affects up to 5.2.4.5. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50845 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory.This issue affects GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: from n/a through 2.3.28.
Product
GeoDirectory – WordPress Business Directory Plugin, or Classified Directory
Affected
up to 2.3.28
What to do
Affects up to 2.3.28. Update GeoDirectory – WordPress Business Directory Plugin, or Classified Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Mail logging – WP Mail Catcher: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50844 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in James Ward Mail logging – WP Mail Catcher.This issue affects Mail logging – WP Mail Catcher: from n/a through 2.1.3.
Product
Mail logging – WP Mail Catcher
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Mail logging – WP Mail Catcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Clockwork SMS Notfications: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50843 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Clockwork Clockwork SMS Notfications.This issue affects Clockwork SMS Notfications: from n/a through 3.0.4.
Product
Clockwork SMS Notfications
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Clockwork SMS Notfications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023MF Gig Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50842 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar: from n/a through 1.2.1.
Product
MF Gig Calendar
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50841 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.72.
Product
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
Affected
up to 1.0.72
What to do
Affects up to 1.0.72. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Booking Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50840 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop, oplugins Booking Manager.This issue affects Booking Manager: from n/a through 2.1.5.
Product
Booking Manager
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Pre* Party Resource Hints: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50855 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sam Perrow Pre* Party Resource Hints.This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.
Product
Pre* Party Resource Hints
Affected
up to 1.8.18
What to do
Affects up to 1.8.18. Update Pre* Party Resource Hints to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Squirrly SEO - Advanced Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50854 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly Squirrly SEO - Advanced Pack.This issue affects Squirrly SEO - Advanced Pack: from n/a before 2.4.02.
Product
Squirrly SEO - Advanced Pack
Fixed in
2.4.02
What to do
Update Squirrly SEO - Advanced Pack to 2.4.02 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.