Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
78 results · page 2 of 2
Jun 4, 2024Download IP2Location Country Blocker: Authentication Bypass by SpoofingCVE-2023-37865 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in IP2Location Download IP2Location Country Blocker allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Download IP2Location Country Blocker: from n/a through 2.29.1.
- Product
- Download IP2Location Country Blocker
- Affected
- up to 2.29.1
- What to do
- Affects up to 2.29.1. Update Download IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 15, 2024Download IP2Location Country Blocker: Cross-Site Request Forgery (CSRF)CVE-2024-32443 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in IP2Location Download IP2Location Country Blocker.This issue affects Download IP2Location Country Blocker: from n/a through 2.34.2.
- Product
- Download IP2Location Country Blocker
- Affected
- up to 2.34.2
- What to do
- Affects up to 2.34.2. Update Download IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 26, 2024Location Picker at Checkout for WooCommerce: Missing AuthorizationCVE-2024-24719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Uriahs Victor Location Picker at Checkout for WooCommerce.This issue affects Location Picker at Checkout for WooCommerce: from n/a through 1.8.9.
- Product
- Location Picker at Checkout for WooCommerce
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update Location Picker at Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 31, 2024Stock Locations for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22153 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood & Alexandre Faustino Stock Locations for WooCommerce allows Stored XSS.This issue affects Stock Locations for WooCommerce: from n/a through 2.5.9.
- Product
- Stock Locations for WooCommerce
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update Stock Locations for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 24, 2024IP2Location Country Blocker: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-22294 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Blocker: from n/a through 2.33.3.
- Product
- IP2Location Country Blocker
- Affected
- up to 2.33.3
- What to do
- Affects up to 2.33.3. Update IP2Location Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro: Does not sanitise and escape some of its settingsCVE-2023-5005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro
- Fixed in
- 3.0
- What to do
- Update Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro to 3.0 or newer.
Dec 15, 2023Track Geolocation Of Users Using Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49188 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.This issue affects Track Geolocation Of Users Using Contact Form 7: from n/a through 2.0.
- Product
- Track Geolocation Of Users Using Contact Form 7
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Track Geolocation Of Users Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in themelocation Remove Add to Cart WooCommerce plugin <= 1.4.4.CVE-2023-46629 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themelocation Remove Add to Cart WooCommerce plugin <= 1.4.4.
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 24, 2023Auto Location for WP Job Manager via Google: Does not sanitise and escape some of its settingsCVE-2023-3344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Auto Location for WP Job Manager via Google
- Fixed in
- 1.1
- What to do
- Update Auto Location for WP Job Manager via Google to 1.1 or newer.
Jul 1, 2023Locations: Cross-Site Request ForgeryCVE-2021-4394 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to update custom field meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Locations
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Unauthorized back-up location changesCVE-2020-36667 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backup_guard_cloud_dropbox, backup_guard_cloud_gdrive, and backup_guard_cloud_oneDrive functions. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to change to location of back-ups and potentially steal sensitive information from them.
- Product
- JetBackup – WP Backup, Migrate & Restore
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 13, 2023Location Weather: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0360 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Location Weather
- Fixed in
- 1.3.4
- What to do
- Update Location Weather to 1.3.4 or newer.
Oct 17, 2022Helpful: Puts the exported logs and feedbacks in a publicly accessible location and guessable namesCVE-2022-2834 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin's settings
- Product
- Helpful
- Fixed in
- 4.5.26
- What to do
- Update Helpful to 4.5.26 or newer.
Mar 14, 2022CommonsBooking: Does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queriesCVE-2022-0658 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
- Product
- CommonsBooking
- Fixed in
- 2.6.8
- What to do
- Update CommonsBooking to 2.6.8 or newer.
Feb 7, 2022IP2Location Country Blocker: Does not have CSRF check in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25108 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.6
- What to do
- Update IP2Location Country Blocker to 2.26.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URLCVE-2021-25096 · WordPress plugins & themes · reported by WPScanMedium 6.5
The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.5
- What to do
- Update IP2Location Country Blocker to 2.26.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022IP2Location Country Blocker: Does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25095 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.5
- What to do
- Update IP2Location Country Blocker to 2.26.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 8, 2021Simple Download Monitor: Saves logs in a predictable locationCVE-2021-24695 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
- Product
- Simple Download Monitor
- Fixed in
- 3.9.6
- What to do
- Update Simple Download Monitor to 3.9.6 or newer.
Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_creatCVE-2021-38346 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory traversal, and the file contents were populated via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin added a .jpg extension to all uploaded filenames, a double extension attack was still possible, e.g. a file named shell.php would be saved as shell.php.jpg, and would be executable on a number of common configurations.
- Product
- Brizy Page Builder
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Brizy Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 21, 2021In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameCVE-2021-24361 · WordPress plugins & themes · reported by WPScanCritical 9.8
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.
- Product
- Location Manager
- Fixed in
- 2.1.0.10
- What to do
- Update Location Manager to 2.1.0.10 or newer.
Full record and what to do →NVD recordwpgeodirectory.comwpscan.com
Jun 1, 2021WP Super Cache: Did not properly sanitise its wp_cache_location parameter in its settingsCVE-2021-24329 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue.
- Product
- WP Super Cache
- Fixed in
- 1.7.3
- What to do
- Update WP Super Cache to 1.7.3 or newer.
Apr 5, 2021WP Super Cache: Was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location optionCVE-2021-24209 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
- Product
- WP Super Cache
- Fixed in
- 1.7.2
- What to do
- Update WP Super Cache to 1.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 18, 2021Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable toCVE-2021-24130 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+).
- Product
- WP Google Map
- Fixed in
- 4.1.5
- What to do
- Update WP Google Map to 4.1.5 or newer.
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.CVE-2020-15364 · WordPress plugins & themes · reported by MITREMedium 6.1
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
- Product
- Nexos
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 20, 2019The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.CVE-2015-9403 · WordPress plugins & themes · reported by MITREMedium 6.1
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Sep 13, 2019The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.CVE-2016-10938 · WordPress plugins & themes · reported by MITREMedium 6.5
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordadvisories.dxw.comwordpress.org
Aug 14, 2019The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.CVE-2017-18510 · WordPress plugins & themes · reported by MITREHigh 8.8
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
- Product
- custom-sidebars
- Fixed in
- 3.1.0
- What to do
- Update custom-sidebars to 3.1.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.CVE-2015-9307 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
- Product
- wp-google-map-plugin
- Fixed in
- 2.3.10
- What to do
- Update wp-google-map-plugin to 2.3.10 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.