Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

111 results · page 2 of 3

Dec 16, 2024Display Future Posts: Cross-Site Request Forgery (CSRF)CVE-2024-54413 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in brandt-net Display Future Posts display-future-posts allows Stored XSS.This issue affects Display Future Posts: from n/a through <= 0.2.3.
Product
Display Future Posts
Affected
up to 0.2.3
What to do
Affects up to 0.2.3. Update Display Future Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more: Stored Cross-Site ScriptingCVE-2024-11766 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_book_showcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024Display custom fields in the frontend – Post and User Profile Fields: Missing AuthorizationCVE-2023-31073 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0.
Product
Display custom fields in the frontend – Post and User Profile Fields
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Fast Video and Image Display: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51935 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Perrow Fast Video and Image Display fast-video-and-image-display allows DOM-Based XSS.This issue affects Fast Video and Image Display: from n/a through <= 2.5.2.
Product
Fast Video and Image Display
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Fast Video and Image Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024OpenCart Product Display: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajinkyanahar OpenCart Product Display opencart-product-display allows Stored XSS.This issue affects OpenCart Product Display: from n/a through <= 1.0.
Product
OpenCart Product Display
Affected
up to 1.0
What to do
Affects up to 1.0. Update OpenCart Product Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Display Terms Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seothemes Display Terms Shortcode display-terms-shortcode allows Stored XSS.This issue affects Display Terms Shortcode: from n/a through <= 1.0.4.
Product
Display Terms Shortcode
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Display Terms Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Countdown Timer block – Display the event's date into a timer.: Information ExposureCVE-2024-10669 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the [ctb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Countdown Timer block – Display the event's date into a timer.
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Countdown Timer block – Display the event's date into a timer. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 4, 2024Display Medium Posts: Stored Cross-Site ScriptingCVE-2024-9445 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_medium_posts shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Display Medium Posts
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update Display Medium Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 6, 2024WP ULike: Does not properly sanitize user display namesCVE-2024-6792 · WordPress plugins & themes · reported by WPScanLow 3.5
The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.
Product
WP ULike
Fixed in
4.7.2.1
What to do
Update WP ULike to 4.7.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2024Quiz and Survey Master (QSM): Fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embeddedCVE-2024-6879 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.
Product
Quiz and Survey Master (QSM)
Fixed in
9.1.1
What to do
Update Quiz and Survey Master (QSM) to 9.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2024Magical Posts Display – Elementor & Gutenberg Posts Blocks: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37951 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Noor alam Magical Posts Display – Elementor & Gutenberg Posts Blocks allows Stored XSS.This issue affects Magical Posts Display – Elementor & Gutenberg Posts Blocks: from n/a through 1.2.38.
Product
Magical Posts Display – Elementor & Gutenberg Posts Blocks
Affected
up to 1.2.38
What to do
Affects up to 1.2.38. Update Magical Posts Display – Elementor & Gutenberg Posts Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 20, 2024The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values fCVE-2024-4565 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
Product
Advanced Custom Fields (ACF)
Fixed in
6.3
What to do
Update Advanced Custom Fields (ACF) to 6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 3, 2024WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outpuCVE-2024-4439 · WordPress plugins & themes · reported by WordfenceHigh 7.2
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
May 2, 2024Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page: Unauthorized access of dataCVE-2024-0908 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and including, 1.13.4. This makes it possible for unauthenticated attackers to retrieve all post data, including those that may be password protected.
Product
Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page
Affected
up to 1.13.4
What to do
Affects up to 1.13.4. Update Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 11, 2024Inline Related Posts: Is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayedCVE-2023-6257 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts
Product
Inline Related Posts
Fixed in
3.6.0
What to do
Update Inline Related Posts to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 2, 2024Product Sort and Display for WooCommerce: Unauthorized modification of dataCVE-2024-1807 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the psad_update_product_cat_custom_meta_ajax function in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to hide product categories.
Product
Product Sort and Display for WooCommerce
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Product Sort and Display for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2024Hubbub Lite: Does not ensure that user have access to password protected post before displaying its content in a meta tagCVE-2024-1526 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its content in a meta tag.
Product
Hubbub Lite
Fixed in
1.33.1
What to do
Update Hubbub Lite to 1.33.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Cross-Site Request ForgeryCVE-2024-0374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'create_view' function. This makes it possible for unauthenticated attackers to create views via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Cross-Site Request ForgeryCVE-2024-0373 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'save_view' function. This makes it possible for unauthenticated attackers to modify arbitrary post titles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized access of dataCVE-2024-0372 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_form_fields' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to create form views.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized modification of dataCVE-2024-0371 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'create_view' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to create form views.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized modification of dataCVE-2024-0370 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_view' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to modify the titles of arbitrary posts.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Display custom fields in the frontend – Post and User Profile Fields: Code InjectionCVE-2023-6996 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin's vg_display_data shortcode in all versions up to, and including, 1.2.1 due to insufficient input validation and restriction on access to that shortcode. This makes it possible for authenticated attackers with contributor-level and above permissions to call arbitrary functions and execute code.
Product
Display custom fields in the frontend – Post and User Profile Fields
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Display custom fields in the frontend – Post and User Profile Fields: Insecure Direct Object ReferenceCVE-2023-6983 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.1 via the vg_display_data shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve potentially sensitive post meta.
Product
Display custom fields in the frontend – Post and User Profile Fields
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Display custom fields in the frontend – Post and User Profile Fields: Stored Cross-Site ScriptingCVE-2023-6982 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and postmeta in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Display custom fields in the frontend – Post and User Profile Fields
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 30, 2023Display Custom Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48317 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Vatsa Display Custom Post allows Stored XSS.This issue affects Display Custom Post: from n/a through 2.2.1.
Product
Display Custom Post
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Display Custom Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-40674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management allows Stored XSS.This issue affects Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: from n/a through 118.
Product
Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management
Affected
up to 118
What to do
Affects up to 118. Update Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023POST SMTP Mailer: Does not escape email message content before displaying it in the backendCVE-2023-5958 · WordPress plugins & themes · reported by WPScanMedium 6.1
The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
Product
POST SMTP Mailer
Fixed in
2.7.1
What to do
Update POST SMTP Mailer to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.CVE-2023-28419 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.
Affected
up to 1.2
What to do
Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023WordPress File Sharing: Does not check authorization before displaying files and foldersCVE-2023-4836 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced
Product
WordPress File Sharing
Fixed in
2.0.5
What to do
Update WordPress File Sharing to 2.0.5 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Oct 16, 2023ActivityPub: Does not ensure that post contents to be displayed are public and belong to the pluginCVE-2023-3707 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue.
Product
ActivityPub
Fixed in
1.0.0
What to do
Update ActivityPub to 1.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023ActivityPub: Does not ensure that post titles to be displayed are public and belong to the pluginCVE-2023-3706 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector
Product
ActivityPub
Fixed in
1.0.0
What to do
Update ActivityPub to 1.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023Simple Blog Card: Does not ensure that posts to be displayed via a shortcode are publicCVE-2023-4036 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones
Product
Simple Blog Card
Fixed in
1.32
What to do
Update Simple Blog Card to 1.32 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2023Contact Form Email: Does not escape submitted values before displaying them in the HTMLCVE-2023-2718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.
Product
Contact Form Email
Fixed in
1.3.38
What to do
Update Contact Form Email to 1.3.38 or newer.
Full record and what to do →NVD record wpscan.com onvio.nl
May 31, 2023Display post meta, term meta, comment meta, and user meta: Stored Cross-Site ScriptingCVE-2023-1661 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post metadata in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Display post meta, term meta, comment meta, and user meta
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Display post meta, term meta, comment meta, and user meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 17, 2023W4 Post List: Does not ensure that password protected posts can be accessed before displaying their contentCVE-2023-1371 · WordPress plugins & themes · reported by WPScanMedium 6.5
The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them
Product
W4 Post List
Fixed in
2.4.6
What to do
Update W4 Post List to 2.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023WP Tiles: Does not ensure that posts to be displayed are not draft/privateCVE-2023-1426 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Tiles WordPress plugin through 1.1.2 does not ensure that posts to be displayed are not draft/private, allowing any authenticated users, such as subscriber to retrieve the titles of draft and privates posts for example. AN attacker could also retrieve the title of any other type of post.
Product
WP Tiles
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Tiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Article Directory: Does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panelCVE-2023-0422 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.
Product
Article Directory
Affected
up to 1.3
What to do
Affects up to 1.3. Update Article Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023All-In-One Security (AIOS): Does not limit what log files to display in it's settings pagesCVE-2023-0156 · WordPress plugins & themes · reported by WPScanMedium 4.9
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
Product
All-In-One Security (AIOS)
Fixed in
5.1.5
What to do
Update All-In-One Security (AIOS) to 5.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the requestCVE-2023-0890 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
Product
WordPress Shortcodes Plugin — Shortcodes Ultimate
Fixed in
5.12.8
What to do
Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Duplicator: Does not authenticate or authorize visitors before displaying information about the system suchCVE-2022-2552 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.
Product
Duplicator
Fixed in
1.4.7
What to do
Update Duplicator to 1.4.7 or newer.
Full record and what to do →NVD record github.com wpscan.com
Aug 1, 2022YaySMTP: Does not have capability check before displaying the Mailer Credentials in JS code for the settingsCVE-2022-2370 · WordPress plugins & themes · reported by WPScanMedium 6.5
The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them
Product
YaySMTP
Fixed in
2.2.1
What to do
Update YaySMTP to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2022WP Contact Slider: Does not sanitize and escape the Text to Display settings of slidersCVE-2022-1301 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
WP Contact Slider
Fixed in
2.4.7
What to do
Update WP Contact Slider to 2.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022underConstruction: Does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting itCVE-2022-1896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.
Product
underConstruction
Fixed in
1.21
What to do
Update underConstruction to 1.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022WP Subtitle: Adds a subtitle field and provides a shortcode to display it via [wp_subtitle]CVE-2022-1393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle is stored as a custom post meta with the key: "wps_subtitle", which is sanitized upon post save/update, however is not sanitized when updating it directly from the post meta update button (via AJAX) - and this makes the XSS exploitable by authenticated users with a role as low as contributor.
Product
WP Subtitle
Fixed in
3.4.1
What to do
Update WP Subtitle to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Display Post Metadata: Adds a shortcode to print out custom fieldsCVE-2021-24855 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Product
Display Post Metadata
Fixed in
1.5.0
What to do
Update Display Post Metadata to 1.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Squaretype: Allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpointCVE-2021-24840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request.
Product
Squaretype
Fixed in
3.0.4
What to do
Update Squaretype to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Visual Link Preview: Does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated usersCVE-2021-24635 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL
Product
Visual Link Preview
Fixed in
2.2.3
What to do
Update Visual Link Preview to 2.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Edit Role functionality in the Display Users: Had an `id` parameterCVE-2021-24400 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an `id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
Edit Role functionality in the Display Users
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Edit Role functionality in the Display Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jul 12, 2021In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "ShCVE-2021-24454 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.
Product
YOP Poll
Fixed in
6.2.8
What to do
Update YOP Poll to 6.2.8 or newer.
Full record and what to do →NVD record wpscan.com in-spired.xyz

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.