Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
83 results · page 2 of 2
Jan 7, 2025SSL Wireless SMS Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56284 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows SQL Injection.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.5.0.
- Product
- SSL Wireless SMS Notification
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025CoCart – Headless ecommerce: Missing AuthorizationCVE-2023-47241 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CoCart Headless CoCart – Headless ecommerce cart-rest-api-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoCart – Headless ecommerce: from n/a through <= 3.11.2.
- Product
- CoCart – Headless ecommerce
- Affected
- up to 3.11.2
- What to do
- Affects up to 3.11.2. Update CoCart – Headless ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024SSL Wireless SMS Notification: Incorrect Privilege AssignmentCVE-2024-56220 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.6.0.
- Product
- SSL Wireless SMS Notification
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Sensitive Information ExposureCVE-2024-11291 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
- Product
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- Affected
- up to 2.13.4
- What to do
- Affects up to 2.13.4. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024Borderless: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54211 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visualmodo Borderless borderless allows Cross-Site Scripting (XSS).This issue affects Borderless: from n/a through <= 1.5.8.
- Product
- Borderless
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Borderless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 11, 2024Christian Science Bible Lesson Subjects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52353 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gabriel Serafini Christian Science Bible Lesson Subjects christian-science-bible-lesson-subjects allows DOM-Based XSS.This issue affects Christian Science Bible Lesson Subjects: from n/a through <= 2.0.
- Product
- Christian Science Bible Lesson Subjects
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Christian Science Bible Lesson Subjects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Arbitrary shortcode executionCVE-2024-10261 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.13.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- Affected
- up to 2.13.0
- What to do
- Affects up to 2.13.0. Update The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 28, 2024Swoop 1-Click Login: Passwordless Authentication: Authentication Bypass by Primary WeaknessCVE-2024-50478 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordless Authentication: 1.4.5.
- Product
- Swoop 1-Click Login: Passwordless Authentication
- What to do
- Update Swoop 1-Click Login: Passwordless Authentication to the newest version.
Oct 20, 2024Endless Posts Navigation: Cross-Site Request Forgery (CSRF)CVE-2024-49629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through <= 2.2.7.
- Product
- Endless Posts Navigation
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Endless Posts Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Reflected Cross-Site ScriptingCVE-2024-9222 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- Affected
- up to 2.12.8
- What to do
- Affects up to 2.12.8. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 21, 2024Easy Custom Code (LESS/CSS/JS) – Live editing: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37536 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Web357 Easy Custom Code (LESS/CSS/JS) – Live editing allows Stored XSS.This issue affects Easy Custom Code (LESS/CSS/JS) – Live editing: from n/a through 1.0.8.
- Product
- Easy Custom Code (LESS/CSS/JS) – Live editing
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Easy Custom Code (LESS/CSS/JS) – Live editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024Solid Security: Use of Less Trusted SourceCVE-2022-44593 · WordPress plugins & themes · reported by PatchstackLow 3.7
Use of Less Trusted Source vulnerability in SolidWP Solid Security allows HTTP DoS.This issue affects Solid Security: from n/a through 9.3.1.
- Product
- Solid Security
- Affected
- up to 9.3.1
- What to do
- Affects up to 9.3.1. Update Solid Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Headless CMS: Missing AuthorizationCVE-2023-34186 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3.
- Product
- Headless CMS
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Headless CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Borderless: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34757 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visualmodo Borderless borderless allows DOM-Based XSS.This issue affects Borderless: from n/a through <= 1.7.3.
- Product
- Borderless
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Borderless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2024-4666 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 6, 2024WP-Stateless – Google Cloud Storage: Unauthorized loss of dataCVE-2024-1385 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to the current time, which may completely take a site offline.
- Product
- WP-Stateless – Google Cloud Storage
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update WP-Stateless – Google Cloud Storage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 25, 2024The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of posCVE-2024-1564 · WordPress plugins & themes · reported by WPScanMedium 4.3
The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode
- Product
- wp-schema-pro
- Fixed in
- 2.7.16
- What to do
- Update wp-schema-pro to 2.7.16 or newer.
Mar 19, 2024Passwordless Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29143 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs, sareiodata Passwordless Login passwordless-login allows Stored XSS.This issue affects Passwordless Login: from n/a through 1.1.2.
- Product
- Passwordless Login
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Passwordless Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 17, 2024WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27959 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management allows Reflected XSS.This issue affects WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management: from n/a through 4.2.9.
- Product
- WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 4, 2024Events Tickets Plus: Does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of statusCVE-2024-1319 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
- Product
- Events Tickets Plus
- Fixed in
- 5.9.1
- What to do
- Update Events Tickets Plus to 5.9.1 or newer.
Feb 28, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Unauthorized modification of dataCVE-2024-1390 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creating_pricing_table_page function in all versions up to, and including, 2.11.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create pricing tables.
- Product
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- Affected
- up to 2.11.1
- What to do
- Affects up to 2.11.1. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Unauthorized modification of dataCVE-2024-1389 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to change the Stripe payment keys.
- Product
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- Affected
- up to 2.11.1
- What to do
- Affects up to 2.11.1. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2023GoCardless: Authorization Bypass Through User-Controlled KeyCVE-2023-37871 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.
- Product
- GoCardless
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update GoCardless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 29, 2023A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress.CVE-2005-10002 · WordPress plugins & themes · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.
- Product
- almosteffortless secure-files
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update almosteffortless secure-files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2023Scriptless Social Sharing: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0377 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Scriptless Social Sharing
- Fixed in
- 3.2.2
- What to do
- Update Scriptless Social Sharing to 3.2.2 or newer.
Feb 13, 2023A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress.CVE-2022-4905 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 is able to address this issue. The patch is identified as 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. It is recommended to upgrade the affected component. VDB-220750 is the identifier assigned to this vulnerability.
- Affected
- 3.1.1 to 3.1.1
- What to do
- Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2022Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.CVE-2022-36387 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 20, 2022Seamless Donations: Does not have CSRF check in placeCVE-2022-1610 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Seamless Donations
- Fixed in
- 5.1.9
- What to do
- Update Seamless Donations to 5.1.9 or newer.
Nov 23, 2021Video Lessons Manager: And Video Lessons Manager Pro WordPress plugin before 3CVE-2021-24713 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks
- Product
- Video Lessons Manager
- Fixed in
- 1.7.2
- What to do
- Update Video Lessons Manager to 1.7.2 or newer.
Oct 11, 2019The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, CVE-2015-9491 · WordPress plugins & themes · reported by MITREHigh 7.5
The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
- Product
- ThemeMakers Blessing Premium Responsive
- Affected
- up to 2015-05-15
- What to do
- Affects up to 2015-05-15. Update ThemeMakers Blessing Premium Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 5, 2019Online Lesson Booking 0.8.6 and earlier: Cross-site request forgery (CSRF)CVE-2019-5973 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- Online Lesson Booking 0.8.6 and earlier
- Affected
- up to 0.8.6
- What to do
- Affects up to 0.8.6. Update Online Lesson Booking 0.8.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 5, 2019Online Lesson Booking 0.8.6 and earlier: Cross-site scriptingCVE-2019-5972 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Online Lesson Booking 0.8.6 and earlier
- Affected
- up to 0.8.6
- What to do
- Affects up to 0.8.6. Update Online Lesson Booking 0.8.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 21, 2012Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which tCVE-2012-2401 · WordPress plugins & themes · reported by MITREMedium 5
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
- Fixed in
- 1.5.4
- What to do
- Update the plugin to 1.5.4 or newer.
Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.