Updated 30 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

95 results · page 2 of 2

Jan 24, 2025HelloAsso: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24575 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso allows Stored XSS.This issue affects HelloAsso: from n/a through <= 1.1.11.
Product
HelloAsso
Affected
up to 1.1.11
What to do
Affects up to 1.1.11. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Event Espresso 4 Decaf: Cross-Site Request Forgery (CSRF)CVE-2024-56251 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Cross Site Request Forgery.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.28.decaf.
Product
Event Espresso 4 Decaf
Affected
up to 5.0.28.decaf
What to do
Affects up to 5.0.28.decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WPSSO Core: Missing AuthorizationCVE-2024-56243 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JS Morisset WPSSO Core wpsso allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSSO Core: from n/a through <= 18.18.1.
Product
WPSSO Core
Affected
up to 18.18.1
What to do
Affects up to 18.18.1. Update WPSSO Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Blossom Shop: Cross-Site Request Forgery (CSRF)CVE-2024-37412 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Blossom Shop blossom-shop allows Cross Site Request Forgery.This issue affects Blossom Shop: from n/a through <= 1.1.7.
Product
Blossom Shop
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Blossom Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024vBSSO-lite: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54297 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in extremeidea vBSSO-lite vbsso-lite allows Authentication Bypass.This issue affects vBSSO-lite: from n/a through <= 1.4.3.
Product
vBSSO-lite
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update vBSSO-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 11, 2024OAuth Single Sign On – SSO (OAuth Client): Authentication bypassCVE-2024-10111 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.26.3
What to do
Affects up to 6.26.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 9, 2024BlossomThemes Email Newsletter: Missing AuthorizationCVE-2023-47849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Blossom Themes BlossomThemes Email Newsletter blossomthemes-email-newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through <= 2.2.4.
Product
BlossomThemes Email Newsletter
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update BlossomThemes Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Amazon Associate Filter: Cross-Site Request Forgery (CSRF)CVE-2024-51643 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ragaskar Amazon Associate Filter amazon-associate-filter allows Stored XSS.This issue affects Amazon Associate Filter: from n/a through <= 0.4.
Product
Amazon Associate Filter
Affected
up to 0.4
What to do
Affects up to 0.4. Update Amazon Associate Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024Christian Science Bible Lesson Subjects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52353 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gabriel Serafini Christian Science Bible Lesson Subjects christian-science-bible-lesson-subjects allows DOM-Based XSS.This issue affects Christian Science Bible Lesson Subjects: from n/a through <= 2.0.
Product
Christian Science Bible Lesson Subjects
Affected
up to 2.0
What to do
Affects up to 2.0. Update Christian Science Bible Lesson Subjects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024HelloAsso: Missing AuthorizationCVE-2024-44052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10.
Product
HelloAsso
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 4, 2024Auto Amazon Links – Amazon Associates Affiliate: Reflected Cross-Site ScriptingCVE-2024-9349 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Auto Amazon Links – Amazon Associates Affiliate
Affected
up to 5.4.2
What to do
Affects up to 5.4.2. Update Auto Amazon Links – Amazon Associates Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2024HelloAsso: Unauthorized modification of dataCVE-2024-7605 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' function in all versions up to, and including, 1.1.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to update plugin options, potentially disrupting the service.
Product
HelloAsso
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 21, 2024Event Espresso 4 Decaf – Event Registration Event Ticketing: Limited unauthorized plugin settings modificationCVE-2024-6883 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to a missing capability check on the saveTimezoneString and some other functions in all versions up to and including 4.10.46.decaf. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify some of the plugin settings.
Product
Event Espresso 4 Decaf – Event Registration Event Ticketing
Affected
up to 4.10.46.decaf
What to do
Affects up to 4.10.46.decaf. Update Event Espresso 4 Decaf – Event Registration Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 31, 2024CTT Expresso para WooCommerce: Sensitive information exposureCVE-2024-6687 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly accessible and contain sensitive information such as sender and receiver names, phone numbers, physical addresses, and email addresses
Product
CTT Expresso para WooCommerce
Affected
up to 3.2.12
What to do
Affects up to 3.2.12. Update CTT Expresso para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 21, 2024HelloAsso: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37488 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.9.
Product
HelloAsso
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 26, 2024BlossomThemes Email Newsletter: Server-Side Request Forgery (SSRF)CVE-2024-37098 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Blossom Themes BlossomThemes Email Newsletter.This issue affects BlossomThemes Email Newsletter: from n/a through 2.2.6.
Product
BlossomThemes Email Newsletter
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update BlossomThemes Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Highcompress Image Compressor: Missing AuthorizationCVE-2023-40209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Himalaya Saxena Highcompress Image Compressor.This issue affects Highcompress Image Compressor: from n/a through 6.0.0.
Product
Highcompress Image Compressor
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update Highcompress Image Compressor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 5, 2024EasyAzon – Amazon Associates Affiliate: Reflected Cross-Site ScriptingCVE-2023-6956 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘easyazon-cloaking-locale’ parameter in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
EasyAzon – Amazon Associates Affiliate
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update EasyAzon – Amazon Associates Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 3, 2024Event Espresso 4 Decaf: Missing AuthorizationCVE-2023-27437 · WordPress plugins & themes · reported by PatchstackLow 3.7
Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf allows Functionality Misuse.This issue affects Event Espresso 4 Decaf: from n/a through 4.10.44.Decaf.
Product
Event Espresso 4 Decaf
Affected
up to 4.10.44.Decaf
What to do
Affects up to 4.10.44.Decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024HelloAsso: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso allows Stored XSS.This issue affects HelloAsso: from n/a through 1.1.5.
Product
HelloAsso
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 12, 2024Blossom Spa: Sensitive Information ExposureCVE-2024-2107 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generated source. This makes it possible for unauthenticated attackers to extract sensitive data including contents of password-protected or scheduled posts.
Product
Blossom Spa
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Blossom Spa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Feb 1, 2024Auto Amazon Links – Amazon Associates Affiliate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52175 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Uno (miunosoft) Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1.
Product
Auto Amazon Links – Amazon Associates Affiliate
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Auto Amazon Links – Amazon Associates Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023assorted[chips] DrawIt: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47831 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in assorted[chips] DrawIt (draw.Io) plugin <= 1.1.3 versions.
Product
assorted[chips] DrawIt
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update assorted[chips] DrawIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.CVE-2023-28749 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <= 120 versions.CVE-2023-45606 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <= 120 versions.
Affected
up to 120
What to do
Affects up to 120. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions.CVE-2023-41667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions.
Affected
up to 4.4.5
What to do
Affects up to 4.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 18, 2023OAuth Single Sign On – SSO (OAuth Client): Improper AuthenticationCVE-2022-34155 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.23.3
What to do
Affects up to 6.23.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes patchstack.com
Jul 1, 2023Event Espresso 4 Decaf: Cross-Site Request ForgeryCVE-2021-4404 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This is due to missing or incorrect nonce validation on the ajaxHandler() function. This makes it possible for unauthenticated attackers to op into notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Event Espresso 4 Decaf
Affected
up to 4.10.11
What to do
Affects up to 4.10.11. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jan 30, 2023The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium MultisiCVE-2022-4496 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.
Product
SAML SSO Standard
Fixed in
16.0.8
What to do
Update SAML SSO Standard to 16.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.CVE-2022-37338 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 22, 2022Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.CVE-2022-34858 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.
Affected
up to 1.11.3
What to do
Affects up to 1.11.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes patchstack.com
Nov 23, 2021Video Lessons Manager: And Video Lessons Manager Pro WordPress plugin before 3CVE-2021-24713 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks
Product
Video Lessons Manager
Fixed in
1.7.2
What to do
Update Video Lessons Manager to 1.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 15, 2021plugins/wordpress_sso/pages/index.php: ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site ScriptingCVE-2021-41951 · WordPress plugins & themes · reported by MITREMedium 6.1
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.
Product
plugins/wordpress_sso/pages/index.php
Fixed in
9.6
What to do
Update plugins/wordpress_sso/pages/index.php to 9.6 or newer.
Full record and what to do →NVD record horizon3.ai horizon3.ai
Sep 29, 2021The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site uCVE-2021-39342 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8.
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 20, 2021Availability Calendar: Does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embedCVE-2021-24604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Availability Calendar
Fixed in
1.2.2
What to do
Update Availability Calendar to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2021A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in thCVE-2020-26153 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Fixed in
4.10.7.p
What to do
Update the plugin to 4.10.7.p or newer.
Full record and what to do →NVD record github.com labs.nettitude.com
Nov 2, 2020WordPress before 5.5.2 allows XSS associated with global variables.CVE-2020-28034 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.5.2 allows XSS associated with global variables.
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record lists.debian.org lists.fedoraproject.org
Feb 5, 2020The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.CVE-2019-20173 · WordPress plugins & themes · reported by MITREMedium 6.1
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
Product
Auth0 wp-auth0 plugin 3.11.x
Fixed in
3.11.3
What to do
Update Auth0 wp-auth0 plugin 3.11.x to 3.11.3 or newer.
Full record and what to do →NVD record auth0.com github.com
Aug 22, 2019The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.CVE-2016-10928 · WordPress plugins & themes · reported by MITREHigh 7.5
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
Product
onelogin-saml-sso
Fixed in
2.2.0
What to do
Update onelogin-saml-sso to 2.2.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Jul 5, 2019Online Lesson Booking 0.8.6 and earlier: Cross-site request forgery (CSRF)CVE-2019-5973 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Online Lesson Booking 0.8.6 and earlier
Affected
up to 0.8.6
What to do
Affects up to 0.8.6. Update Online Lesson Booking 0.8.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp olbsys.com
Jul 5, 2019Online Lesson Booking 0.8.6 and earlier: Cross-site scriptingCVE-2019-5972 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Online Lesson Booking 0.8.6 and earlier
Affected
up to 0.8.6
What to do
Affects up to 0.8.6. Update Online Lesson Booking 0.8.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp olbsys.com
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Product
wp-slimstat (aka Slimstat Analytics)
Fixed in
4.1.6.1
What to do
Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Sep 27, 2017SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recuCVE-2017-14760 · WordPress plugins & themes · reported by MITRECritical 9.8
SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php.
Product
event-espresso-free (aka Event Espresso Lite)
Affected
up to 3.1.37.12.l
What to do
Affects up to 3.1.37.12.l. Update event-espresso-free (aka Event Espresso Lite) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sstrunk.com sstrunk.com
Sep 14, 2017Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameterCVE-2017-1002026 · WordPress plugins & themes · reported by larry0@me.comHigh 8.8
Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.
Affected
3.1.37.11.l to 3.1.37.11.l
What to do
Affects 3.1.37.11.l to 3.1.37.11.l. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
May 3, 2012The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, whichCVE-2012-1936 · WordPress plugins & themes · reported by MITREMedium 6.8
The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.