Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

124 results · page 2 of 3

Apr 4, 2025CMP – Coming Soon & Maintenance: Unrestricted Upload of File with Dangerous TypeCVE-2025-32118 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious Files.This issue affects CMP – Coming Soon & Maintenance: from n/a through <= 4.1.14.
Product
CMP – Coming Soon & Maintenance
Affected
up to 4.1.14
What to do
Affects up to 4.1.14. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025CM Header and Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31091 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer cm-header-footer-script-loader allows Stored XSS.This issue affects CM Header and Footer: from n/a through <= 1.2.4.
Product
CM Header and Footer
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update CM Header and Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025CM Download Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30910 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CreativeMindsSolutions CM Download Manager cm-download-manager allows Path Traversal.This issue affects CM Download Manager: from n/a through <= 2.9.6.
Product
CM Download Manager
Affected
up to 2.9.6
What to do
Affects up to 2.9.6. Update CM Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025ACME Divi Modules: Missing AuthorizationCVE-2025-31540 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in acmemediakits ACME Divi Modules acme-divi-modules allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACME Divi Modules: from n/a through <= 1.3.5.
Product
ACME Divi Modules
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update ACME Divi Modules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 14, 2025CM FAQ – Simplify support with an intuitive FAQ management tool: Reflected Cross-Site ScriptingCVE-2025-2166 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CM FAQ – Simplify support with an intuitive FAQ management tool
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update CM FAQ – Simplify support with an intuitive FAQ management tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 6, 2025Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics: Unauthorized modification of dataCVE-2025-1666 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the send_uninstall_survey() function in all versions up to, and including, 4.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit the uninstall survey on behalf of a website.
Product
Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 3, 2025CM Map Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24758 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.0.8.
Product
CM Map Locations
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update CM Map Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025CM Pop-Up banners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Reflected XSS.This issue affects CM Pop-Up banners: from n/a through <= 1.7.6.
Product
CM Pop-Up banners
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update CM Pop-Up banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025CMC MIGRATE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This issue affects CMC MIGRATE: from n/a through <= 0.0.3.
Product
CMC MIGRATE
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update CMC MIGRATE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025MACME: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23683 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xdxdVSxdxd MACME macme allows Reflected XSS.This issue affects MACME: from n/a through <= 1.2.
Product
MACME
Affected
up to 1.2
What to do
Affects up to 1.2. Update MACME to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024CM Answers: Missing AuthorizationCVE-2024-54267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Answers: from n/a through <= 3.2.6.
Product
CM Answers
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update CM Answers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024WCMultiShipping: Missing AuthorizationCVE-2023-48274 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCMultiShipping: from n/a through 2.3.5.
Product
WCMultiShipping
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update WCMultiShipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Acme Fix Images: Missing AuthorizationCVE-2023-47793 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Acme Themes Acme Fix Images acme-fix-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through <= 1.0.0.
Product
Acme Fix Images
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Acme Fix Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 2, 2024CMSMasters Elementor Addon: Stored Cross-Site ScriptingCVE-2024-9694 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CMSMasters Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.14.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CMSMasters Elementor Addon
Affected
up to 1.14.7
What to do
Affects up to 1.14.7. Update CMSMasters Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.cmsmasters.net wordfence.com
Nov 26, 2024Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient inpuCVE-2024-11202 · WordPress plugins & themes · reported by WordfenceMedium 6.1
Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024CM Table Of Contents: Does not have CSRF checkCVE-2024-5029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
CM Table Of Contents
Fixed in
1.2.4
What to do
Update CM Table Of Contents to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com
Nov 18, 2024CM Table Of Contents: Does not have CSRF check in placeCVE-2024-5030 · WordPress plugins & themes · reported by WPScanLow 3.8
The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Product
CM Table Of Contents
Fixed in
1.2.3
What to do
Update CM Table Of Contents to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2024CM Tooltip Glossary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48041 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary enhanced-tooltipglossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through <= 4.3.9.
Product
CM Tooltip Glossary
Affected
up to 4.3.9
What to do
Affects up to 4.3.9. Update CM Tooltip Glossary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2024CMSMasters Content Composer: Stored Cross-Site ScriptingCVE-2024-7963 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CMSMasters Content Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's multiple shortcodes in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CMSMasters Content Composer
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update CMSMasters Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cmsmasters.net wordfence.com
Sep 12, 2024CM Pop-Up Banners for: Does not sanitise and escape some of its popup fieldsCVE-2024-5799 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as Contributors to perform Cross-Site Scripting attacks.
Product
CM Pop-Up Banners for
Fixed in
1.7.3
What to do
Update CM Pop-Up Banners for to 1.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2024White Label CMS: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43303 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in videousermanuals.Com White Label CMS allows Reflected XSS.This issue affects White Label CMS: from n/a through 2.7.4.
Product
White Label CMS
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update White Label CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024CM Tooltip Glossary: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43149 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through 4.3.7.
Product
CM Tooltip Glossary
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update CM Tooltip Glossary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 22, 2024CM Popup Plugin for WordPress: Does not sanitise and escape some of the campaign settingsCVE-2024-5004 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Product
CM Popup Plugin for WordPress
Fixed in
1.6.6
What to do
Update CM Popup Plugin for WordPress to 1.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024CM Email Registration Blacklist and Whitelist: Does not have CSRF checkCVE-2024-5167 · WordPress plugins & themes · reported by WPScanHigh 8.1
The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or whitelist, which could allow attackers to make a logged in admin add or delete settings from the blacklist or whitelist menu via a CSRF attack
Product
CM Email Registration Blacklist and Whitelist
Fixed in
1.4.9
What to do
Update CM Email Registration Blacklist and Whitelist to 1.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024CM WordPress Search And Replace: Does not have CSRF checks in some placesCVE-2024-5028 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Product
CM WordPress Search And Replace
Fixed in
1.3.9
What to do
Update CM WordPress Search And Replace to 1.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2024Headless CMS: Missing AuthorizationCVE-2023-34186 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3.
Product
Headless CMS
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Headless CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024White Label CMS: Unauthorized modification of dataCVE-2024-4280 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_plugin function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to reset plugin settings.
Product
White Label CMS
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update White Label CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024CM Tooltip Glossary – Powerful Glossary: Cross-Site Request ForgeryCVE-2024-4086 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings or reset them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CM Tooltip Glossary – Powerful Glossary
Affected
up to 4.2.11
What to do
Affects up to 4.2.11. Update CM Tooltip Glossary – Powerful Glossary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024CMB2: PHP Object InjectionCVE-2024-1792 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CMB2 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.1 via deserialization of untrusted input from the text_datetime_timestamp_timezone field. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Please note that the plugin is a developer toolkit. For the vulnerability to become exploitable, the presence of a metabox activation in your code (via functions.php for example) is required.
Product
CMB2
Affected
up to 2.10.1
What to do
Affects up to 2.10.1. Update CMB2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 28, 2024CMP – Coming Soon & Maintenance: Server-Side Request Forgery (SSRF)CVE-2023-50374 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.10.
Product
CMP – Coming Soon & Maintenance
Affected
up to 4.1.10
What to do
Affects up to 4.1.10. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack
Product
CM Download Manager
Fixed in
2.9.1
What to do
Update CM Download Manager to 2.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1232 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack
Product
CM Download Manager
Fixed in
2.9.0
What to do
Update CM Download Manager to 2.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1231 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack
Product
CM Download Manager
Fixed in
2.9.0
What to do
Update CM Download Manager to 2.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 20, 2023CM Popup Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30750 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This issue affects CM Popup Plugin for WordPress: from n/a through 1.5.10.
Product
CM Popup Plugin for
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update CM Popup Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.CVE-2023-28749 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 20, 2023CMS Commander: Authorization bypassCVE-2023-3325 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmsc_add_site' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the '_cmsc_public_key' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation. This can only be exploited if the plugin has not been configured yet, however, if combined with another arbitrary plugin installation and activation vulnerability, the impact can be severe.
Product
CMS Commander
Affected
up to 2.287
What to do
Affects up to 2.287. Update CMS Commander to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023CMP – Coming Soon & Maintenance: Maintenance Mode BypassCVE-2023-2159 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to visit a site placed in maintenance mode thus bypassing the plugin's provided feature.
Product
CMP – Coming Soon & Maintenance
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2023CMP: Authorization bypassCVE-2020-36730 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.
Product
CMP
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update CMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Mar 7, 2023CMP – Coming Soon & Maintenance: Information ExposureCVE-2023-1263 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled.
Product
CMP – Coming Soon & Maintenance
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 2, 2023White Label CMS: Unserializes user input provided via the settingsCVE-2022-4302 · WordPress plugins & themes · reported by WPScanHigh 7.2
The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
Product
White Label CMS
Fixed in
2.5
What to do
Update White Label CMS to 2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 18, 2022WPML Multilingual CMS premium plugin <= 4.5.10 on: Broken Access ControlCVE-2022-38974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.
Product
WPML Multilingual CMS premium plugin <= 4.5.10 on
Affected
up to 4.5.10
What to do
Affects up to 4.5.10. Update WPML Multilingual CMS premium plugin <= 4.5.10 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.CVE-2022-45072 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.
Affected
up to 4.5.13
What to do
Affects up to 4.5.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.CVE-2022-45071 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.
Affected
up to 4.5.13
What to do
Affects up to 4.5.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022WPML Multilingual CMS premium plugin <= 4.5.10 on: Broken Access ControlCVE-2022-38461 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).
Product
WPML Multilingual CMS premium plugin <= 4.5.10 on
Affected
up to 4.5.10
What to do
Affects up to 4.5.10. Update WPML Multilingual CMS premium plugin <= 4.5.10 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 26, 2022CM Download Manager: Allows high privilege users suchCVE-2022-3076 · WordPress plugins & themes · reported by WPScanHigh 7.2
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
Product
CM Download Manager
Fixed in
2.8.6
What to do
Update CM Download Manager to 2.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022White Label CMS: Does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewingCVE-2022-0422 · WordPress plugins & themes · reported by WPScanMedium 6.1
The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue
Product
White Label CMS
Fixed in
2.2.9
What to do
Update White Label CMS to 2.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022CMP: Allows any userCVE-2022-0188 · WordPress plugins & themes · reported by WPScanMedium 5.3
The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.
Product
CMP
Fixed in
4.0.19
What to do
Update CMP to 4.0.19 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 4, 2021CM Tooltip Glossary: Does not escape some glossary_tooltip shortcode attributesCVE-2021-24678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
CM Tooltip Glossary
Fixed in
3.9.21
What to do
Update CM Tooltip Glossary to 3.9.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 7, 2021Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibCVE-2020-24146 · WordPress plugins & themes · reported by MITREHigh 8.1
Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action.
Product
CM Download Manager (aka cm-download-manager)
Affected
2.7.0 to 2.7.0
What to do
Affects 2.7.0 to 2.7.0. Update CM Download Manager (aka cm-download-manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitCVE-2020-24145 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action.
Product
CM Download Manager (aka cm-download-manager)
Affected
2.7.0 to 2.7.0
What to do
Affects 2.7.0 to 2.7.0. Update CM Download Manager (aka cm-download-manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.