Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
139 results · page 2 of 3
Jun 27, 2025EC Stars Rating: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53296 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ecoal95 EC Stars Rating ec-stars-rating allows Stored XSS.This issue affects EC Stars Rating: from n/a through <= 1.0.11.
- Product
- EC Stars Rating
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update EC Stars Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Seven Stars: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31067 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Seven Stars allows Stored XSS. This issue affects Seven Stars: from n/a through 1.4.4.
- Product
- Seven Stars
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Seven Stars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Beaver Builder Plugin (Starter Version): Arbitrary file uploadsCVE-2025-4102 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.
- Product
- Beaver Builder Plugin (Starter Version)
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Beaver Builder Plugin (Starter Version) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwpbeaverbuilder.com
May 23, 2025HotStar – Multi-Purpose Business: Deserialization of Untrusted DataCVE-2025-31069 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
- Product
- HotStar – Multi-Purpose Business
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HotStar – Multi-Purpose Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025HotStar – Multi-Purpose Business: Missing AuthorizationCVE-2025-31071 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
- Product
- HotStar – Multi-Purpose Business
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HotStar – Multi-Purpose Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Seven Stars: Cross-Site Request Forgery (CSRF)CVE-2025-31068 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themeton Seven Stars allows Cross Site Request Forgery. This issue affects Seven Stars: from n/a through 1.4.4.
- Product
- Seven Stars
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Seven Stars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Starfish Review Generation & Marketing: Missing AuthorizationCVE-2025-39533 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Starfish Reviews Starfish Review Generation & Marketing starfish-reviews allows Privilege Escalation.This issue affects Starfish Review Generation & Marketing: from n/a through <= 3.1.19.
- Product
- Starfish Review Generation & Marketing
- Affected
- up to 3.1.19
- What to do
- Affects up to 3.1.19. Update Starfish Review Generation & Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Review Stars Count For WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32687 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magnigenie Review Stars Count For WooCommerce review-stars-count-for-woocommerce allows SQL Injection.This issue affects Review Stars Count For WooCommerce: from n/a through <= 2.0.
- Product
- Review Stars Count For WooCommerce
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Review Stars Count For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder: Stored Cross-Site ScriptingCVE-2024-12189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom widgets in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that you may need to recreate any custom widgets or reinstall the plugin to ensure the issue is adequately patched.
- Product
- WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 27, 2025Five Star Restaurant Reservations: Missing AuthorizationCVE-2025-30861 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.6.29.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.6.29
- What to do
- Affects up to 2.6.29. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2025Ayyash Studio — The kick-start kit: Stored Cross-Site ScriptingCVE-2025-2576 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Ayyash Studio — The kick-start kit
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Ayyash Studio — The kick-start kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 8, 2025Starter Templates by FancyWP: Blind Server-Side Request ForgeryCVE-2024-13924 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'http_request_host_is_external' filter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Starter Templates by FancyWP
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Starter Templates by FancyWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 24, 2025Contact Form 7 Star Rating with font Awesome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27304 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating with font Awesome contact-form-7-star-rating-with-font-awersome allows Stored XSS.This issue affects Contact Form 7 Star Rating with font Awesome: from n/a through <= 1.3.
- Product
- Contact Form 7 Star Rating with font Awesome
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Contact Form 7 Star Rating with font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Contact Form 7 Star Rating: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27303 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelogger Contact Form 7 Star Rating contact-form-7-star-rating allows Stored XSS.This issue affects Contact Form 7 Star Rating: from n/a through <= 1.10.
- Product
- Contact Form 7 Star Rating
- Affected
- up to 1.10
- What to do
- Affects up to 1.10. Update Contact Form 7 Star Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 15, 2025Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive: Server-Side Request ForgeryCVE-2024-13834 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remote_request' function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 7, 2025Starter Templates by FancyWP: Cross-Site Request Forgery (CSRF)CVE-2025-25106 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP starter-templates allows Cross Site Request Forgery.This issue affects Starter Templates by FancyWP: from n/a through <= 2.0.0.
- Product
- Starter Templates by FancyWP
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Starter Templates by FancyWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Starter Templates: Cross-Site Request Forgery (CSRF)CVE-2025-24568 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates astra-sites allows Cross Site Request Forgery.This issue affects Starter Templates: from n/a through <= 4.4.9.
- Product
- Starter Templates
- Affected
- up to 4.4.9
- What to do
- Affects up to 4.4.9. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025Plestar Directory Listing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23723 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hdw player Plestar Directory Listing plestar-directory-listing allows Reflected XSS.This issue affects Plestar Directory Listing: from n/a through <= 1.0.
- Product
- Plestar Directory Listing
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Plestar Directory Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in CVE-2024-13511 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in its settings reset functionality. The issue exists in the settings_init() function, which processes a reset action based on specific query parameters in the URL. The related delete_settings() function performs a faulty nonce validation check, making the reset operation insecure and susceptible to unauthorized access.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 18, 2025Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings: Stored Cross-Site ScriptingCVE-2024-13392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_reviews' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2025Goldstar: Missing AuthorizationCVE-2025-23962 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in jjtrabucco Goldstar goldstar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Goldstar: from n/a through <= 2.1.1.
- Product
- Goldstar
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Goldstar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Stars SMTP Mailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23453 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Reflected XSS.This issue affects Stars SMTP Mailer: from n/a through <= 1.7.
- Product
- Stars SMTP Mailer
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Stars SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025kk Star Ratings: Missing AuthorizationCVE-2023-46639 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.5.
- Product
- kk Star Ratings
- Affected
- up to 5.4.5
- What to do
- Affects up to 5.4.5. Update kk Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 21, 2024The kk Star Ratings – Rate Post & Collect User Feedbacks: Arbitrary shortcode executionCVE-2024-11977 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Note: This vulnerability was only partially patched in version 5.4.10.1, and fully patched in 5.4.10.2
- Product
- The kk Star Ratings – Rate Post & Collect User Feedbacks
- Affected
- up to 5.4.10
- What to do
- Affects up to 5.4.10. Update The kk Star Ratings – Rate Post & Collect User Feedbacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 13, 2024Yet Another Stars Rating: Missing AuthorizationCVE-2023-39305 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Dash Labs Yet Another Stars Rating yet-another-stars-rating allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yet Another Stars Rating: from n/a through <= 3.4.3.
- Product
- Yet Another Stars Rating
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Yet Another Stars Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024kk Star Ratings: Missing AuthorizationCVE-2023-36528 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.3.
- Product
- kk Star Ratings
- Affected
- up to 5.4.3
- What to do
- Affects up to 5.4.3. Update kk Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Rate My Post – Star Rating Plugin by FeedbackWP: Insecure Direct Object ReferenceCVE-2024-12309 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.4 via the get_post_status() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to vote on unpublished scheduled posts.
- Product
- Rate My Post – Star Rating Plugin by FeedbackWP
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update Rate My Post – Star Rating Plugin by FeedbackWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 5, 2024Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials: Local File InclusionCVE-2024-11429 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'stars-testimonials-with-slider-and-masonry-grid' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
- Product
- Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials
- Affected
- up to 3.3.3
- What to do
- Affects up to 3.3.3. Update Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 9, 20245 Stars Rating Funnel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51579 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.4.01.
- Product
- 5 Stars Rating Funnel
- Affected
- up to 1.4.01
- What to do
- Affects up to 1.4.01. Update 5 Stars Rating Funnel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024Stars SMTP Mailer: Unrestricted Upload of File with Dangerous TypeCVE-2024-50530 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Upload a Web Shell to a Web Server.This issue affects Stars SMTP Mailer: from n/a through <= 2.2.1.
- Product
- Stars SMTP Mailer
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Stars SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2024Starter Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47345 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through <= 4.4.0.
- Product
- Starter Templates
- Affected
- up to 4.4.0
- What to do
- Affects up to 4.4.0. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2024Spice Starter Sites: Unauthorized modification of dataCVE-2024-8430 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo content.
- Product
- Spice Starter Sites
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Spice Starter Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 1, 2024Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials: Stored Cross-Site ScriptingCVE-2024-8989 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stars_testimonials shortcode in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2024Starbox: Does not properly render social media profiles URLs in certain contextsCVE-2024-8239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role to conduct Stored XSS attacks.
- Product
- Starbox
- Fixed in
- 3.5.3
- What to do
- Update Starbox to 3.5.3 or newer.
Sep 25, 2024Masterstudy LMS Starter: Insertion of Sensitive Information into Log FileCVE-2024-43990 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a through 1.1.8.
- Product
- Masterstudy LMS Starter
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Masterstudy LMS Starter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Spice Starter Sites: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44003 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spicethemes Spice Starter Sites spice-starter-sites allows Reflected XSS.This issue affects Spice Starter Sites: from n/a through <= 1.2.5.
- Product
- Spice Starter Sites
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Spice Starter Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2024Starbox: Does not sanitise and escape some of its settingsCVE-2024-7955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Starbox
- Fixed in
- 3.5.2
- What to do
- Update Starbox to 3.5.2 or newer.
Sep 4, 2024The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site ImportsCVE-2024-8325 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the ‘blockspare_render_social_sharing_block’ function in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 18, 2024Visual Composer Starter: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43263 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Visual Composer Visual Composer Starter allows Stored XSS.This issue affects Visual Composer Starter: from n/a through 3.3.
- Product
- Visual Composer Starter
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Visual Composer Starter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2024The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – TemplateCVE-2024-6872 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – TemplateSpare plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'templatespare_activate_required_theme' and 'templatespare_get_theme_status' functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate any installed theme and read any theme status. If the attacker attempts to activate a theme that is not installed, a non-existent theme with the slug chosen by the attacker will be considered the active theme, leaving the site with no theme functionality.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024aThemes Starter Sites: Stored Cross-Site ScriptingCVE-2024-6897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- aThemes Starter Sites
- Affected
- up to 1.0.53
- What to do
- Affects up to 1.0.53. Update aThemes Starter Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2024Premium Starter Templates: Missing AuthorizationCVE-2023-41805 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Brainstorm Force Premium Starter Templates, Brainstorm Force Starter Templates astra-sites.This issue affects Premium Starter Templates: from n/a through 3.2.5; Starter Templates: from n/a through 3.2.5.
- Product
- Premium Starter Templates
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Premium Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 9, 20245 Stars Rating Funnel: Missing AuthorizationCVE-2024-32725 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.2.67.
- Product
- 5 Stars Rating Funnel
- Affected
- up to 1.2.67
- What to do
- Affects up to 1.2.67. Update 5 Stars Rating Funnel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 6, 2024Startklar Elementor Addons: Directory TraversalCVE-2024-5153 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory.
- Product
- Startklar Elementor Addons
- Affected
- up to 1.7.15
- What to do
- Affects up to 1.7.15. Update Startklar Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 5, 2024Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme.: Stored Cross-Site ScriptingCVE-2024-5222 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme.
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2024Starter Templates — Elementor, WordPress & Beaver Builder Templates: Stored Cross-Site ScriptingCVE-2024-4630 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Starter Templates — Elementor, WordPress & Beaver Builder Templates
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Starter Templates — Elementor, WordPress & Beaver Builder Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2024Starter Templates — Elementor, WordPress & Beaver Builder Templates: Server-Side Request ForgeryCVE-2024-1467 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Starter Templates — Elementor, WordPress & Beaver Builder Templates
- Affected
- up to 4.1.6
- What to do
- Affects up to 4.1.6. Update Starter Templates — Elementor, WordPress & Beaver Builder Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2024Startklar Elementor Addons: Arbitrary file deletionCVE-2024-4346 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
- Product
- Startklar Elementor Addons
- Affected
- up to 1.7.13
- What to do
- Affects up to 1.7.13. Update Startklar Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2024Startklar Elementor Addons: Arbitrary file uploadsCVE-2024-4345 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process' function in the 'startklarDropZoneUploadProcess' class in versions up to, and including, 1.7.13. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Startklar Elementor Addons
- Affected
- up to 1.7.13
- What to do
- Affects up to 1.7.13. Update Startklar Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 29, 2024Five Star Restaurant Reservations: Missing AuthorizationCVE-2024-33596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Five Star Plugins Five Star Restaurant Reservations.This issue affects Five Star Restaurant Reservations: from n/a through 2.6.16.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.6.16
- What to do
- Affects up to 2.6.16. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.