Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

1,989 results · page 17 of 40

Dec 28, 2023Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50857 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.
Product
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Soledad – Multipurpose, Newspaper, Blog & WooCommerce: Deserialization of Untrusted DataCVE-2023-49826 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Product
Soledad – Multipurpose, Newspaper, Blog & WooCommerce
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Soledad – Multipurpose, Newspaper, Blog & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Soledad – Multipurpose, Newspaper, Blog & WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49825 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Product
Soledad – Multipurpose, Newspaper, Blog & WooCommerce
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Soledad – Multipurpose, Newspaper, Blog & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Jquery news ticker: Stored Cross-Site ScriptingCVE-2023-5432 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jquery news ticker
Affected
up to 3.1
What to do
Affects up to 3.1. Update Jquery news ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2023Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: Cross-Site Request Forgery (CSRF)CVE-2023-33214 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
Product
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Affected
up to 3.1
What to do
Affects up to 3.1. Update Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Soledad – Multipurpose, Newspaper, Blog & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49827 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Product
Soledad – Multipurpose, Newspaper, Blog & WooCommerce
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Soledad – Multipurpose, Newspaper, Blog & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 7, 2023URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, andCVE-2023-47548 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site.This issue affects Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site: from n/a through 1.3.2.
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 4, 2023Easy Newsletter Signups: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5108 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Easy Newsletter Signups
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Easy Newsletter Signups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Frontend File Manager: Has a vulnerability that allows an Editor+ user to bypass the file download logic and download files suchCVE-2023-5105 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as `wp-config.php`
Product
Frontend File Manager
Fixed in
22.6
What to do
Update Frontend File Manager to 22.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 30, 2023CartFlows Pro: Cross-Site Request Forgery (CSRF)CVE-2023-36685 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: from n/a through 1.11.12.
Product
CartFlows Pro
Affected
up to 1.11.12
What to do
Affects up to 1.11.12. Update CartFlows Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023Asgaros Forum: Allows forum administratorsCVE-2023-5604 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.
Product
Asgaros Forum
Fixed in
2.7.1
What to do
Update Asgaros Forum to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2023The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WCVE-2023-5815 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes it possible for unauthenticated attackers to include arbitrary PHP files and achieve remote code execution. On vulnerable Docker configurations it may be possible for an attacker to create a PHP file and then subsequently include it to achieve RCE.
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 22, 2023WP Customer Reviews: Sensitive Information ExposureCVE-2023-4686 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.
Product
WP Customer Reviews
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.3.1 versions.CVE-2023-27453 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.3.1 versions.
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 20, 2023The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change tCVE-2023-4824 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2023AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-47757 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth: from n/a through 7.3.9.
Product
AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth
Affected
up to 7.3.9
What to do
Affects up to 7.3.9. Update AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.2.2 versions.CVE-2023-47686 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.2.2 versions.
Affected
up to 2.7.2.2
What to do
Affects up to 2.7.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.4.1 versions.CVE-2023-31078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.4.1 versions.
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions.CVE-2023-30478 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions.
Affected
up to 4.8.8
What to do
Affects up to 4.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions.CVE-2023-34025 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions.
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Emails & Newsletters with Jackmail: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46821 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.
Product
Emails & Newsletters with Jackmail
Affected
up to 1.2.22
What to do
Affects up to 1.2.22. Update Emails & Newsletters with Jackmail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023ReviewX – Multi-criteria Rating & Reviews for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46809 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.
Product
ReviewX – Multi-criteria Rating & Reviews for WooCommerce
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update ReviewX – Multi-criteria Rating & Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Simple Newsletter Plugin – Noptin: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46803 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.
Product
Simple Newsletter Plugin – Noptin
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update Simple Newsletter Plugin – Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Site Reviews: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46801 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.
Product
Site Reviews
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45810 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2.
Product
Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce
Affected
up to 5.5.2
What to do
Affects up to 5.5.2. Update Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46802 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
Product
Product Reviews Import Export for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Product Reviews Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023SendPress Newsletters: Stored Cross-Site ScriptingCVE-2023-5660 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.22.3.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SendPress Newsletters
Affected
up to 1.22.3.31
What to do
Affects up to 1.22.3.31. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in TheFreeWindows Auto Limit Posts Reloaded plugin <= 2.5 versions.CVE-2023-46778 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in TheFreeWindows Auto Limit Posts Reloaded plugin <= 2.5 versions.
Affected
up to 2.5
What to do
Affects up to 2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023WP fade in text news: SQL InjectionCVE-2023-5437 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP fade in text news
Affected
up to 12.0
What to do
Affects up to 12.0. Update WP fade in text news to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023Jquery news ticker: SQL InjectionCVE-2023-5430 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Jquery news ticker
Affected
up to 3.0
What to do
Affects up to 3.0. Update Jquery news ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 30, 2023Bellows Accordion Menu: Stored Cross-Site ScriptingCVE-2023-5164 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bellows Accordion Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bellows Accordion Menu
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Bellows Accordion Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023WP Customer Reviews: Stored Cross-Site ScriptingCVE-2023-4648 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Customer Reviews
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2023Widgets for Google Reviews: Cross-Site Request ForgeryCVE-2023-3254 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Widgets for Google Reviews
Affected
up to 10.9
What to do
Affects up to 10.9. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2023File Manager Pro: Allows admin users to upload arbitrary filesCVE-2023-4861 · WordPress plugins & themes · reported by WPScanHigh 7.2
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.
Product
File Manager Pro
Fixed in
1.8.1
What to do
Update File Manager Pro to 1.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023DoLogin Security: Does not restrict the access of a widget that shows the IPs of failed logins to low privileged usersCVE-2023-4800 · WordPress plugins & themes · reported by WPScanMedium 6.5
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
Product
DoLogin Security
Fixed in
3.7.1
What to do
Update DoLogin Security to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.CVE-2023-45048 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.
Affected
up to 5.00
What to do
Affects up to 5.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.CVE-2023-41730 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.
Affected
up to 1.22.3.31
What to do
Affects up to 1.22.3.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <= 1.06 versions.CVE-2023-41669 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Live News plugin <= 1.06 versions.
Affected
up to 1.06
What to do
Affects up to 1.06. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 14, 2023WS Facebook Like Box Widget: Stored Cross-Site ScriptingCVE-2023-4963 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WS Facebook Like Box Widget
Affected
up to 5.0
What to do
Affects up to 5.0. Update WS Facebook Like Box Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settingsCVE-2023-3170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
tagDiv Composer
Fixed in
4.2
What to do
Update tagDiv Composer to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST routCVE-2023-3169 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.
Product
tagDiv Composer
Fixed in
4.2
What to do
Update tagDiv Composer to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2023Newsletter: Stored Cross-Site ScriptingCVE-2023-4772 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'newsletter_form' shortcode in versions up to, and including, 7.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Newsletter
Affected
up to 7.8.9
What to do
Affects up to 7.8.9. Update Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 7, 2023Qubely: Allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX actionCVE-2021-24916 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.
Product
Qubely
Fixed in
1.8.6
What to do
Update Qubely to 1.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions.CVE-2023-37889 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions.
Affected
up to 2.0.13
What to do
Affects up to 2.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2023Absolute Reviews: Cross-Site Request ForgeryCVE-2021-4426 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the metabox_review_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Absolute Reviews
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Absolute Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.4.1 versions.CVE-2023-35774 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.4.1 versions.
Fixed in
2.4.2
What to do
Update the plugin to 2.4.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in LWS Cleaner plugin <= 2.3.0 versions.CVE-2023-35781 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LWS Cleaner plugin <= 2.3.0 versions.
Fixed in
2.3.1
What to do
Update the plugin to 2.3.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.CVE-2023-1208 · WordPress plugins & themes · reported by WPScanHigh 7.2
This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.
Fixed in
1.18.11
What to do
Update the plugin to 1.18.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 1, 2023WooCommerce Checkout & Funnel Builder by CartFlows: Cross-Site Request ForgeryCVE-2020-36736 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.15. This is due to missing or incorrect nonce validation on the export_json, import_json, and status_logs_file functions. This makes it possible for unauthenticated attackers to import/export settings and trigger logs showing via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WooCommerce Checkout & Funnel Builder by CartFlows
Affected
up to 1.5.15
What to do
Affects up to 1.5.15. Update WooCommerce Checkout & Funnel Builder by CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 22, 2023Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any loCVE-2023-35093 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.