Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

1,763 results · page 19 of 36

Jan 18, 2025Buzz Club – Night Club, DJ and Music Festival Event: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-0515 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Product
Buzz Club – Night Club, DJ and Music Festival Event
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Buzz Club – Night Club, DJ and Music Festival Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 17, 2025Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media: Unauthorized loss of dataCVE-2024-12071 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_network_post() function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages.
Product
Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 17, 2025WP Hotel Booking: Unauthorized modification of dataCVE-2024-12370 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to add rooms with custom prices.
Product
WP Hotel Booking
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2025Sandbox: Unauthorized accessCVE-2024-13367 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Sandbox plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the export_download action in all versions up to, and including, 0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download an entire copy of a sandbox environment which can contain sensitive information like the wp-config.php file.
Product
Sandbox
Affected
up to 0.4
What to do
Affects up to 0.4. Update Sandbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2025Passwords Manager: Unauthorized modification of dataCVE-2024-12614 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_save_setting' and 'post_new_pass' AJAX actions in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and add passwords.
Product
Passwords Manager
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Passwords Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2025Multi Step Form: Unauthorized limited file uploadCVE-2024-12427 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images.
Product
Multi Step Form
Affected
up to 1.7.23
What to do
Affects up to 1.7.23. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2025NitroPack: Unauthorized arbitrary transient updateCVE-2024-11851 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values.
Product
NitroPack
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 15, 2025NitroPack: Unauthorized modification of dataCVE-2024-11848 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options to a fixed value of '1' which can activate certain options (e.g., enable user registration) or modify certain options in a way that leads to a denial of service condition.
Product
NitroPack
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2025W3 Total Cache: Unauthorized access of dataCVE-2024-12365 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain the plugin's nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications.
Product
W3 Total Cache
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2025W3 Total Cache: Unauthorized modification of dataCVE-2024-12006 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to deactivate the plugin as well as activate and deactivate plugin extensions.
Product
W3 Total Cache
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 10, 2025Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups: Unauthorized accessCVE-2024-12204 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create 100% off coupons, delete posts, delete leads, and update coupon statuses.
Product
Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2025Essential WP Real Estate: Unauthorized accessCVE-2024-13318 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.
Product
Essential WP Real Estate
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Essential WP Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025MIMO Woocommerce Order Tracking: Unauthorized modification of dataCVE-2024-5769 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add, update, and delete shipper tracking settings.
Product
MIMO Woocommerce Order Tracking
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update MIMO Woocommerce Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025Newsletter2Go: Unauthorized modification of dataCVE-2024-12618 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in all versions up to, and including, 4.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset styles.
Product
Newsletter2Go
Affected
up to 4.0.14
What to do
Affects up to 4.0.14. Update Newsletter2Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025Bitly's: Unauthorized modification of dataCVE-2024-12616 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bitly's WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and retrieve plugin settings.
Product
Bitly's
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update Bitly's to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025linkID: Unauthorized access of dataCVE-2024-12542 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
Product
linkID
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update linkID to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025GS Insever Portfolio: Unauthorized modification of dataCVE-2024-12249 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings.
Product
GS Insever Portfolio
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update GS Insever Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 8, 2025Shopping Cart & eCommerce Store: Unauthorized modification of dataCVE-2024-12712 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the webhook function in all versions up to, and including, 5.7.8. This makes it possible for unauthenticated attackers to modify order statuses.
Product
Shopping Cart & eCommerce Store
Affected
up to 5.7.8
What to do
Affects up to 5.7.8. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2025AdForest: Unauthorized modification of dataCVE-2024-12855 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_ad' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete posts, attachments and deactivate a license.
Product
AdForest
Affected
up to 5.1.7
What to do
Affects up to 5.1.7. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 7, 2025The Ultimate WordPress Toolkit – WP Extended: Unauthorized modification and retrieval of dataCVE-2024-11916 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with
Product
The Ultimate WordPress Toolkit – WP Extended
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025RSVP and Event Management: Unauthorized accessCVE-2024-12711 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_delete_attendees() and bulk_delete_questions() in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers to delete questions and attendees and for authenticated users to update question menu orders.
Product
RSVP and Event Management
Affected
up to 2.7.13
What to do
Affects up to 2.7.13. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Jupiter X Core: Unauthorized access of dataCVE-2024-12316 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to export popup templates.
Product
Jupiter X Core
Affected
up to 4.8.5
What to do
Affects up to 4.8.5. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Jupiter X Core: Unauthorized accessCVE-2024-12033 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to sync libraries
Product
Jupiter X Core
Affected
up to 4.8.5
What to do
Affects up to 4.8.5. Update Jupiter X Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025WordPress File Upload: Unauthorized access of dataCVE-2024-12719 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform limited path traversal to view directories and subdirectories in WordPress. Files cannot be viewed.
Product
WordPress File Upload
Affected
up to 4.24.15
What to do
Affects up to 4.24.15. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Croma Music: Unauthorized modification of data that can lead to privilege escalationCVE-2024-12202 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Croma Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'ironMusic_ajax' function in all versions up to, and including, 3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Croma Music
Affected
up to 3.6
What to do
Affects up to 3.6. Update Croma Music to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record croma.irontemplates.com wordfence.com
Jan 7, 2025Export Import Menus: Unauthorized access of dataCVE-2024-10866 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Export Import Menus plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dsp_export_import_menus() function in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to export menu data and settings.
Product
Export Import Menus
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Export Import Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Aurum - WordPress & WooCommerce Shopping: Unauthorized modification of dataCVE-2024-12781 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab_1cl_demo_install_package_content' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite content with imported demo content.
Product
Aurum - WordPress & WooCommerce Shopping
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Aurum - WordPress & WooCommerce Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record documentation.laborator.co wordfence.com
Jan 7, 2025SMS Alert Order Notifications – WooCommerce: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11725 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please note this requires the woocommerce-warranty plugin to be installed in order to be exploited.
Product
SMS Alert Order Notifications – WooCommerce
Affected
up to 3.7.6
What to do
Affects up to 3.7.6. Update SMS Alert Order Notifications – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Social Rocket – Social Sharing: Unauthorized modification of dataCVE-2024-9697 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweet_settings_save() and tweet_settings_update() functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
Social Rocket – Social Sharing
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Social Rocket – Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Host PHP Info: Unauthorized access of dataCVE-2024-12535 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
Product
Host PHP Info
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Host PHP Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor: Unauthorized access of dataCVE-2024-10536 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes.
Product
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025LazyLoad Background Images: Unauthorized modification of dataCVE-2024-12327 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LazyLoad Background Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pblzbg_save_settings() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
LazyLoad Background Images
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update LazyLoad Background Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025WordLift – AI powered SEO – Schema: Unauthorized accessCVE-2024-12176 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJAX action in all versions up to, and including, 3.54.2. This makes it possible for unauthenticated attackers to update the plugin's settings.
Product
WordLift – AI powered SEO – Schema
Affected
up to 3.54.2
What to do
Affects up to 3.54.2. Update WordLift – AI powered SEO – Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 7, 2025Popup – MailChimp, GetResponse and ActiveCampaign Intergrations: Unauthorized loss of dataCVE-2024-12158 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'upc_delete_db_data' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to delete the DB data for the plugin.
Product
Popup – MailChimp, GetResponse and ActiveCampaign Intergrations
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Popup – MailChimp, GetResponse and ActiveCampaign Intergrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 7, 2025Infility Global: Unauthorized modification of dataCVE-2024-11496 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infility_global_ajax function in all versions up to, and including, 2.9.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options and potentially break the site.
Product
Infility Global
Affected
up to 2.9.8
What to do
Affects up to 2.9.8. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Spacer: Unauthorized access of dataCVE-2024-10527 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motech_spacer_callback() function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view limited setting information.
Product
Spacer
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Spacer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 6, 2025ClickDesigns: Unauthorized modification of dataCVE-2024-12559 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ClickDesigns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clickdesigns_add_api' and the 'clickdesigns_remove_api' functions in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to modify or remove the plugin's API key.
Product
ClickDesigns
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update ClickDesigns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 24, 2024MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution: Unauthorized accessCVE-2024-12413 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions like 'marketking_delete_team_member', 'marketkingrejectuser', 'marketking_save_profile_settings', and many more in all versions up to, and including, 2.0.00. This makes it possible for unauthenticated attackers to delete users, update settings, approve users, and more.
Product
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
Affected
up to 2.0.00
What to do
Affects up to 2.0.00. Update MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 24, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Unauthorized access of dataCVE-2024-12190 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bitform-form-entry-edit endpoint in all versions up to, and including, 2.17.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all form submissions from other users.
Product
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
What to do
Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 24, 2024Print Invoice & Delivery Notes for WooCommerce: Unauthorized modification of dataCVE-2024-12210 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcdn_remove_shoplogo' AJAX action in all versions up to, and including, 5.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the shop's logo.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.4.0
What to do
Affects up to 5.4.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 24, 2024WC Price History for Omnibus: Unauthorized accessCVE-2024-12617 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and modify history data.
Product
WC Price History for Omnibus
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update WC Price History for Omnibus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 24, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Unauthorized access of dataCVE-2024-12266 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to import and export product rules along with obtaining phpinfo() data
Product
ELEX WooCommerce Dynamic Pricing and Discounts
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows): Unauthorized access of dataCVE-2024-11852 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layout templates.
Product
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)
Affected
up to 5.10.12
What to do
Affects up to 5.10.12. Update Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024WP BASE Booking of Appointments, Services and Events: Unauthorized access of dataCVE-2024-12558 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive information from the database, such as the hashed administrator password.
Product
WP BASE Booking of Appointments, Services and Events
Affected
up to 4.9.2
What to do
Affects up to 4.9.2. Update WP BASE Booking of Appointments, Services and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2024Maintenance & Coming Soon Redirect Animation: Unauthorized modification of dataCVE-2024-9503 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wploti_add_whitelisted_roles_option', 'wploti_remove_whitelisted_roles_option', 'wploti_add_whitelisted_users_option', 'wploti_remove_whitelisted_users_option', and 'wploti_uploaded_animation_save_option' functions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify certain plugin settings.
Product
Maintenance & Coming Soon Redirect Animation
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Maintenance & Coming Soon Redirect Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2024File Manager Pro – Filester: Unauthorized modification of dataCVE-2024-12331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_plugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Filebird plugin.
Product
File Manager Pro – Filester
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 19, 2024Download Manager: Unauthorized download of password-protected contentCVE-2024-11768 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.
Product
Download Manager
Affected
up to 3.3.03
What to do
Affects up to 3.3.03. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2024Travel Booking: Unauthorized modification of dataCVE-2024-11926 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartnerCreateServiceRental', 'st_delete_order_item', '_st_partner_approve_booking', 'save_order_item', and '__userDenyEachInfo' functions in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify posts, delete posts and pages, approve arbitrary orders, insert orders with arbitrary prices, and deny user information.
Product
Travel Booking
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Travel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record travelerwp.com wordfence.com
Dec 16, 2024WP-NERD Toolkit: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-54279 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tobias Keller WP-NERD Toolkit wp-nerd-toolkit.This issue affects WP-NERD Toolkit: from n/a through <= 1.1.
Product
WP-NERD Toolkit
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP-NERD Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized accessCVE-2024-11715 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an employer.
Product
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.