Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

101 results · page 2 of 3

Apr 8, 20253DPrint Lite: SQL InjectionCVE-2025-3428 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'coating_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
3DPrint Lite
Affected
up to 2.1.3.6
What to do
Affects up to 2.1.3.6. Update 3DPrint Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 8, 20253DPrint Lite: SQL InjectionCVE-2025-3427 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'infill_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
3DPrint Lite
Affected
up to 2.1.3.6
What to do
Affects up to 2.1.3.6. Update 3DPrint Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2025Printus: Missing AuthorizationCVE-2025-31830 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Uriahs Victor Printus printus-cloud-printing-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printus: from n/a through <= 1.2.6.
Product
Printus
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Printus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Print PDF Generator and Publisher: Cross-Site Request Forgery (CSRF)CVE-2025-22637 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Cross Site Request Forgery.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.2.0.
Product
Print PDF Generator and Publisher
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Print PDF Generator and Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 20253DPrint Lite: Cross-Site Request Forgery (CSRF)CVE-2025-30865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in fuzzoid 3DPrint Lite 3dprint-lite allows Cross Site Request Forgery.This issue affects 3DPrint Lite: from n/a through <= 2.1.3.5.
Product
3DPrint Lite
Affected
up to 2.1.3.5
What to do
Affects up to 2.1.3.5. Update 3DPrint Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 8, 2025Print Invoice & Delivery Notes for WooCommerce: Sensitive Information ExposureCVE-2024-13640 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.4.1 via the 'wcdn/invoice' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/wcdn/invoice directory which can contain invoice files if an email attachment setting is enabled.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 3, 2025Helloprint: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26540 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This issue affects Helloprint: from n/a through <= 2.0.7.
Product
Helloprint
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Helloprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Helloprint: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-26534 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This issue affects Helloprint: from n/a through <= 2.0.7.
Product
Helloprint
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Helloprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orCVE-2025-24373 · WordPress plugins & themes · reported by GitHubMedium 6.3
woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orders. This vulnerability allows unauthorized users to access any PDF document from a store if they: 1. Have access to a guest document link and 2. Replace the URL variable `my-account` with `bulk`. The issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerability compromises the confidentiality of sensitive documents, affecting all stores using the plugin with the guest access option enabled. This issue has been addressed in version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Fixed in
4.0.0
What to do
Update the plugin to 4.0.0 or newer.
Full record and what to do →NVD record github.com github.com
Jan 27, 2025Print Barcode Labels for your WooCommerce products/orders: Missing AuthorizationCVE-2025-24603 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through <= 3.4.10.
Product
Print Barcode Labels for your WooCommerce products/orders
Affected
up to 3.4.10
What to do
Affects up to 3.4.10. Update Print Barcode Labels for your WooCommerce products/orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 27, 2025Passwordless WP – Login with your glance or fingerprint: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23792 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Busters Passwordless WP – Login with your glance or fingerprint passwordless-wp allows Reflected XSS.This issue affects Passwordless WP – Login with your glance or fingerprint: from n/a through <= 1.1.6.
Product
Passwordless WP – Login with your glance or fingerprint
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Passwordless WP – Login with your glance or fingerprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2024Print Invoice & Delivery Notes for WooCommerce: Unauthorized modification of dataCVE-2024-12210 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcdn_remove_shoplogo' AJAX action in all versions up to, and including, 5.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the shop's logo.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.4.0
What to do
Affects up to 5.4.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024Printful Integration for WooCommerce: Missing AuthorizationCVE-2022-47168 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in printful Printful Integration for WooCommerce printful-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printful Integration for WooCommerce: from n/a through <= 2.2.3.
Product
Printful Integration for WooCommerce
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Printful Integration for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2022-46795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024Print Science Designer: PHP Object InjectionCVE-2024-12312 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untrusted input through the 'designer-saved-projects' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Print Science Designer
Affected
up to 1.3.152
What to do
Affects up to 1.3.152. Update Print Science Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 20243DPrint Lite: Does not have CSRF check in placeCVE-2024-10480 · WordPress plugins & themes · reported by WPScanMedium 4.3
The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
3DPrint Lite
Fixed in
2.1
What to do
Update 3DPrint Lite to 2.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 18, 2024Print PDF Generator and Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52394 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Stored XSS.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.1.6.
Product
Print PDF Generator and Publisher
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Print PDF Generator and Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2024Helloprint: Unrestricted Upload of File with Dangerous TypeCVE-2024-50525 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in helloprint Helloprint helloprint allows Upload a Web Shell to a Web Server.This issue affects Helloprint: from n/a through <= 2.0.4.
Product
Helloprint
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Helloprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Print Barcode Labels for your WooCommerce products/orders: Missing AuthorizationCVE-2024-43310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in UkrSolution Print Barcode Labels for your WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through 3.4.9.
Product
Print Barcode Labels for your WooCommerce products/orders
Affected
up to 3.4.9
What to do
Affects up to 3.4.9. Update Print Barcode Labels for your WooCommerce products/orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Ahime Image Printer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49245 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through <= 1.0.0.
Product
Ahime Image Printer
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ahime Image Printer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024Contact Form 7 Summary and Print: Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Muhammad Rehman Contact Form 7 Summary and Print allows Stored XSS.This issue affects Contact Form 7 Summary and Print: from n/a through 1.2.5.
Product
Contact Form 7 Summary and Print
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Contact Form 7 Summary and Print to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 22, 2024Print My Blog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37271 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.27.0.
Product
Print My Blog
Affected
up to 3.27.0
What to do
Affects up to 3.27.0. Update Print My Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024BizPrint: Missing AuthorizationCVE-2024-32777 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint.This issue affects BizPrint: from n/a through 4.3.39.
Product
BizPrint
Affected
up to 4.3.39
What to do
Affects up to 4.3.39. Update BizPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 22, 2024Print-O-Matic: Stored Cross-Site ScriptingCVE-2024-3671 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Print-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'print-me' shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes such as 'tag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Print-O-Matic
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update Print-O-Matic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
May 8, 2024Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2024-4233 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; Arconix Shortcodes: from n/a through 2.1.10; Arconix FAQ: from n/a through 1.9.3.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Print My Blog: Missing AuthorizationCVE-2024-33907 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.26.2.
Product
Print My Blog
Affected
up to 3.26.2
What to do
Affects up to 3.26.2. Update Print My Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Print-O-Matic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33936 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Print-O-Matic allows Stored XSS.This issue affects Print-O-Matic: from n/a through 2.1.10.
Product
Print-O-Matic
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update Print-O-Matic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce: Stored Cross-Site ScriptingCVE-2024-1679 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template and javascript label fields in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce: Unauthorized access of data, modification of data, and loss of dataCVE-2024-1677 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to an improper capability check on 42 separate AJAX functions in all versions up to, and including, 3.4.6. This makes it possible for authenticated attackers, with subscriber access and above, to fully control the plugin which includes the ability to modify plugin settings and profiles, and create, edit, retrieve, and delete templates and barcodes.
Product
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2024Print Page block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30438 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Print Page block allows Stored XSS.This issue affects Print Page block: from n/a through 1.0.8.
Product
Print Page block
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Print Page block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024BizPrint: Cross-Site Request Forgery (CSRF)CVE-2024-29773 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint allows Cross-Site Scripting (XSS).This issue affects BizPrint: from n/a through 4.5.5.
Product
BizPrint
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update BizPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 20243DPrint Lite: Does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX actionCVE-2021-4436 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.
Product
3DPrint Lite
Fixed in
1.9.1.5
What to do
Update 3DPrint Lite to 1.9.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Print Invoice & Delivery Notes for WooCommerce: Is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders pageCVE-2023-0479 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.
Product
Print Invoice & Delivery Notes for WooCommerce
Fixed in
4.7.2
What to do
Update Print Invoice & Delivery Notes for WooCommerce to 4.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 20243dprint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-3899 · WordPress plugins & themes · reported by WPScanHigh 8.1
The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged in admin into submitting a form.
Product
3dprint
Fixed in
3.5.6.9
What to do
Update 3dprint to 3.5.6.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 20233DPrint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-4023 · WordPress plugins & themes · reported by WPScanMedium 5.3
The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.
Product
3DPrint
Fixed in
3.5.6.9
What to do
Update 3DPrint to 3.5.6.9 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Jan 23, 2023Print-O-Matic: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4753 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Print-O-Matic
Fixed in
2.1.8
What to do
Update Print-O-Matic to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Helloprint: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-3908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Helloprint
Fixed in
1.4.7
What to do
Update Helloprint to 1.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022Print, PDF, Email by PrintFriendly: Does not sanitise and escape the Custom Button Text settingsCVE-2022-0663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Print, PDF, Email by PrintFriendly
Fixed in
5.2.3
What to do
Update Print, PDF, Email by PrintFriendly to 5.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Web To Print Shop : uDraw: Does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function CVE-2022-0656 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
Product
Web To Print Shop : uDraw
Fixed in
3.3.3
What to do
Update Web To Print Shop : uDraw to 3.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJACVE-2022-0949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
Product
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
Fixed in
6.930
What to do
Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 6.930 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Display Post Metadata: Adds a shortcode to print out custom fieldsCVE-2021-24855 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Product
Display Post Metadata
Fixed in
1.5.0
What to do
Update Display Post Metadata to 1.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021Insert Pages: Adds a shortcode that prints out other pages' content and custom fieldsCVE-2021-24850 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields.
Product
Insert Pages
Fixed in
3.7.0
What to do
Update Insert Pages to 3.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Print-O-Matic: Does not escape some of its settings before outputting them in attributeCVE-2021-24710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Print-O-Matic
Fixed in
2.0.3
What to do
Update Print-O-Matic to 2.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Sep 20, 2021Print My Blog: Does not enforce nonce (CSRF) checksCVE-2021-24636 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link
Product
Print My Blog
Fixed in
3.4.2
What to do
Update Print My Blog to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2019A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress.CVE-2019-17207 · WordPress plugins & themes · reported by MITREMedium 5.4
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.
Product
broken-link-checker (aka Broken Link Checker)
Affected
up to 1.11.8
What to do
Affects up to 1.11.8. Update broken-link-checker (aka Broken Link Checker) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 21, 2019The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.CVE-2018-20970 · WordPress plugins & themes · reported by MITREMedium 6.1
The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
Product
pdf-print
Fixed in
2.0.3
What to do
Update pdf-print to 2.0.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.CVE-2017-18528 · WordPress plugins & themes · reported by MITREMedium 6.1
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
Product
pdf-print
Fixed in
1.9.4
What to do
Update pdf-print to 1.9.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
May 1, 2019HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fakCVE-2019-11633 · WordPress plugins & themes · reported by MITREHigh 7.5
HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fake WordPress templates. This allows attackers to discover and avoid this honeypot system.
Affected
up to 2016-09-27
What to do
Affects up to 2016-09-27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Apr 27, 2019Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.CVE-2019-11565 · WordPress plugins & themes · reported by MITRECritical 9.8
Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.
Product
Server Side Request Forgery (SSRF) exists in the Print My Blog
Fixed in
1.6.7
What to do
Update Server Side Request Forgery (SSRF) exists in the Print My Blog to 1.6.7 or newer.
Full record and what to do →NVD record dumpco.re github.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress allows remote attacCVE-2014-4532 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Product
Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale
Fixed in
1.2.3
What to do
Update Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale to 1.2.3 or newer.
Full record and what to do →NVD record codevigilant.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.