Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
79 results · page 2 of 2
Nov 9, 2024Doofinder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51697 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder doofinder allows Reflected XSS.This issue affects Doofinder: from n/a through <= 0.5.4.
- Product
- Doofinder
- Affected
- up to 0.5.4
- What to do
- Affects up to 0.5.4. Update Doofinder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Super Store Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43975 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through <= 6.9.7.
- Product
- Super Store Finder
- Affected
- up to 6.9.7
- What to do
- Affects up to 6.9.7. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Super Store Finder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43978 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through < 6.9.8.
- Product
- Super Store Finder
- Fixed in
- 6.9.8
- What to do
- Update Super Store Finder to 6.9.8 or newer.
Sep 17, 2024Super Store Finder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43976 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Store Finder: from n/a through <= 6.9.7.
- Product
- Super Store Finder
- Affected
- up to 6.9.7
- What to do
- Affects up to 6.9.7. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Better Find and Replace: Deserialization of Untrusted DataCVE-2024-39636 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1.
- Product
- Better Find and Replace
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Better Find and Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 29, 2024Custom field finder: Deserialization of Untrusted DataCVE-2024-33641 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Team Yoast Custom field finder.This issue affects Custom field finder: from n/a through 0.3.
- Product
- Custom field finder
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Custom field finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 15, 2024Find Duplicates: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32127 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Markus Seyer Find Duplicates.This issue affects Find Duplicates: from n/a through 1.4.6.
- Product
- Find Duplicates
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Find Duplicates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 15, 2024Doofinder for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25596 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder for WooCommerce allows Stored XSS.This issue affects Doofinder for WooCommerce: from n/a through 2.1.8.
- Product
- Doofinder for WooCommerce
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Doofinder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 1, 2024Shortcodes Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-21750 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scribit Shortcodes Finder allows Reflected XSS.This issue affects Shortcodes Finder: from n/a through 1.5.5.
- Product
- Shortcodes Finder
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Shortcodes Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 5, 2024Doofinder WP & WooCommerce Search: Cross-Site Request Forgery (CSRF)CVE-2023-51678 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.0.33.
- Product
- Doofinder WP & WooCommerce Search
- Affected
- up to 2.0.33
- What to do
- Affects up to 2.0.33. Update Doofinder WP & WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 1, 2024Backup Migration: Stores in-progress backups information in easy to findCVE-2023-6271 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups.
- Product
- Backup Migration
- Fixed in
- 1.3.6
- What to do
- Update Backup Migration to 1.3.6 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Dec 19, 2023Doofinder WP & WooCommerce Search: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-40602 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49.
- Product
- Doofinder WP & WooCommerce Search
- Affected
- up to 1.5.49
- What to do
- Affects up to 1.5.49. Update Doofinder WP & WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Doofinder WP & WooCommerce Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49185 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder WP & WooCommerce Search allows Reflected XSS.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.1.7.
- Product
- Doofinder WP & WooCommerce Search
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update Doofinder WP & WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 19, 2023Super Store Finder: Unauthenticated arbitrary email creation and relayCVE-2023-5054 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer.
- Product
- Super Store Finder
- Affected
- up to 6.9.3
- What to do
- Affects up to 6.9.3. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsuperstorefinder.netsuperstorefinder.net
Nov 28, 2022Find and Replace All: Does not have CSRF checkCVE-2022-3850 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 28, 2022Find and Replace All: Does not sanitize and escape some parameters from its setting page before outputting them back to the userCVE-2022-2311 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Jun 20, 2022Better Find and Replace: Does not properly sanitiseCVE-2022-1472 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
- Product
- Better Find and Replace
- Fixed in
- 1.3.6
- What to do
- Update Better Find and Replace to 1.3.6 or newer.
Jun 13, 2022WPMK Ajax Finder: Cross-Site Request ForgeryCVE-2022-1749 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/config/create-plugin-config.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
- Product
- WPMK Ajax Finder
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WPMK Ajax Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 4, 2022Library File Manager: Is using an outdated version of the elFinder libraryCVE-2022-0403 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.
- Product
- Library File Manager
- Fixed in
- 5.2.3
- What to do
- Update Library File Manager to 5.2.3 or newer.
Mar 14, 2022Petfinder Listings: Does not escape its settingsCVE-2022-0702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Petfinder Listings
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Petfinder Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 30, 2021Browser and Operating System Finder versions prior to 1.2: Cross-site request forgery (CSRF)CVE-2021-20851 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.
- Product
- Browser and Operating System Finder versions prior to 1.2
- Fixed in
- 1.2
- What to do
- Update Browser and Operating System Finder versions prior to 1.2 to 1.2 or newer.
Oct 18, 2021Find My Blocks: Does not have authorisation checks in its REST APICVE-2021-24677 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.
- Product
- Find My Blocks
- Fixed in
- 3.4.0
- What to do
- Update Find My Blocks to 3.4.0 or newer.
Oct 4, 2021Better Find and Replace: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24676 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
- Product
- Better Find and Replace
- Fixed in
- 1.2.9
- What to do
- Update Better Find and Replace to 1.2.9 or newer.
Apr 22, 2021The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the requCVE-2021-24238 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.
- Product
- Realteo
- Fixed in
- 1.2.4
- What to do
- Update Realteo to 1.2.4 or newer.
Apr 22, 2021The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius.CVE-2021-24237 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.
- Product
- Realteo
- Fixed in
- 1.2.4
- What to do
- Update Realteo to 1.2.4 or newer.
Dec 13, 2020vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control.CVE-2020-35235 · WordPress plugins & themes · reported by MITREHigh 8.8
vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- vendor/elfinder/php/connector.minimal.php in the secure-file-manager
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update vendor/elfinder/php/connector.minimal.php in the secure-file-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
May 28, 2020An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress.CVE-2020-13641 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser.
- Product
- An issue was discovered in the Real-Time Find and Replace
- Fixed in
- 4.0.2
- What to do
- Update An issue was discovered in the Real-Time Find and Replace to 4.0.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Sep 13, 2019The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.CVE-2016-10955 · WordPress plugins & themes · reported by MITRECritical 9.8
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
- Product
- cysteme-finder
- Fixed in
- 1.4
- What to do
- Update cysteme-finder to 1.4 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary wCVE-2014-4538 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the query parameter.
- Product
- Malware Finder
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Malware Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.