Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

200 results · page 2 of 4

Dec 12, 2025Bookit: Has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment optionsCVE-2025-12841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
Product
Bookit
Fixed in
2.5.1
What to do
Update Bookit to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 12, 2025Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images: Unauthorized loss of dataCVE-2025-12113 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the atgai_delete_api_key() function in all versions up to, and including, 1.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the API key connected to the site.
Product
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 3, 2025CE21 Suite: Unauthorized plugin settings updateCVE-2025-11007 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action in versions 2.2.1 to 2.3.1. This makes it possible for unauthenticated attackers to update the plugin's API settings including a secret key used for authentication. This allows unauthenticated attackers to create new admin accounts on an affected site.
Product
CE21 Suite
Affected
2.2.1 to 2.3.1
What to do
Affects 2.2.1 to 2.3.1. Update CE21 Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 26, 2025SEO Meta Description Updater: Missing AuthorizationCVE-2025-62928 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joby Joseph SEO Meta Description Updater seo-meta-description-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Meta Description Updater: from n/a through <= 1.2.0.
Product
SEO Meta Description Updater
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update SEO Meta Description Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Last Updated Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58683 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luke Mlsna Last Updated Shortcode last-updated-shortcode allows Stored XSS.This issue affects Last Updated Shortcode: from n/a through <= 1.0.1.
Product
Last Updated Shortcode
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Last Updated Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Force Update Translations: Cross-Site Request Forgery (CSRF)CVE-2025-58236 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mayo Moriyama Force Update Translations force-update-translations allows Cross Site Request Forgery.This issue affects Force Update Translations: from n/a through <= 0.5.
Product
Force Update Translations
Affected
up to 0.5
What to do
Affects up to 0.5. Update Force Update Translations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2025Plugin updates blocker: Cross-Site Request ForgeryCVE-2025-9634 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pub_save action handler. This makes it possible for unauthenticated attackers to disable or enable plugin updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Plugin updates blocker
Affected
up to 0.2
What to do
Affects up to 0.2. Update Plugin updates blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 5, 2025Woocommerce Notify Updated Product: Cross-Site Request Forgery (CSRF)CVE-2025-58856 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Notify Updated Product woocommerce-notify-updated-product allows Stored XSS.This issue affects Woocommerce Notify Updated Product: from n/a through <= 1.6.
Product
Woocommerce Notify Updated Product
Affected
up to 1.6
What to do
Affects up to 1.6. Update Woocommerce Notify Updated Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025OceanWP: Is vulnerable to an option update due to a missing capability check on one of its AJAX request handlerCVE-2025-8944 · WordPress plugins & themes · reported by WPScanMedium 4.3
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
Product
OceanWP
Fixed in
4.1.2
What to do
Update OceanWP to 4.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 15, 2025Companion Auto Update: Stored Cross-Site ScriptingCVE-2025-4369 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘update_delay_days’ parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Companion Auto Update
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update Companion Auto Update to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2025WP Dashboard Notes: Does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX actionCVE-2023-7239 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.
Product
WP Dashboard Notes
Fixed in
1.0.11
What to do
Update WP Dashboard Notes to 1.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Apr 24, 2025COVID-19 (Coronavirus) Update Your Customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46523 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devignstudiosltd COVID-19 (Coronavirus) Update Your Customers covid-19-alert allows Stored XSS.This issue affects COVID-19 (Coronavirus) Update Your Customers: from n/a through <= 1.5.1.
Product
COVID-19 (Coronavirus) Update Your Customers
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update COVID-19 (Coronavirus) Update Your Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025WP Editor: Arbitrary file updateCVE-2025-3294 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
Product
WP Editor
Affected
up to 1.2.9.1
What to do
Affects up to 1.2.9.1. Update WP Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 15, 2025Email Notifications for Updates: Missing AuthorizationCVE-2025-26741 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in AWEOS GmbH Email Notifications for Updates wp-update-mail-notification allows Privilege Escalation.This issue affects Email Notifications for Updates: from n/a through <= 1.1.6.
Product
Email Notifications for Updates
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Email Notifications for Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Lock Your Updates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32537 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Lock Your Updates lock-your-updates allows Reflected XSS.This issue affects Lock Your Updates: from n/a through <= 1.1.
Product
Lock Your Updates
Affected
up to 1.1
What to do
Affects up to 1.1. Update Lock Your Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Email Notifications for Updates: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2933 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26741 is likely a duplicate of this issue.
Product
Email Notifications for Updates
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Email Notifications for Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 3, 2025Latest Custom Post Type Updates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Wood Latest Custom Post Type Updates latest-custom-post-type-updates allows Reflected XSS.This issue affects Latest Custom Post Type Updates: from n/a through <= 1.3.0.
Product
Latest Custom Post Type Updates
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Latest Custom Post Type Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Plugins Last Updated Column: Cross-Site Request Forgery (CSRF)CVE-2025-28887 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fastmover Plugins Last Updated Column plugins-last-updated-column allows Cross Site Request Forgery.This issue affects Plugins Last Updated Column: from n/a through <= 0.1.3.
Product
Plugins Last Updated Column
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Plugins Last Updated Column to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Status Updater: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25124 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devu Status Updater fb-status-updater allows Reflected XSS.This issue affects Status Updater: from n/a through <= 1.9.2.
Product
Status Updater
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Status Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Woo Update Variations In Cart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23829 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codingkart Woo Update Variations In Cart woo-update-variations-in-cart allows Stored XSS.This issue affects Woo Update Variations In Cart: from n/a through <= 0.0.9.
Product
Woo Update Variations In Cart
Affected
up to 0.0.9
What to do
Affects up to 0.0.9. Update Woo Update Variations In Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Browser-Update-Notify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23490 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Stursberg Browser-Update-Notify browser-update-notify allows Reflected XSS.This issue affects Browser-Update-Notify: from n/a through <= 0.2.1.
Product
Browser-Update-Notify
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Browser-Update-Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2025Disable Auto Updates: Cross-Site Request ForgeryCVE-2024-13336 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'disable-auto-updates' page. This makes it possible for unauthenticated attackers to disable all auto updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Disable Auto Updates
Affected
up to 1.4
What to do
Affects up to 1.4. Update Disable Auto Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 15, 2025NitroPack: Unauthorized arbitrary transient updateCVE-2024-11851 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values.
Product
NitroPack
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 2, 2025Services updates for customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56034 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Irshad A.Khan Services updates for customers service-updates-for-customers allows Reflected XSS.This issue affects Services updates for customers: from n/a through <= 1.0.
Product
Services updates for customers
Affected
up to 1.0
What to do
Affects up to 1.0. Update Services updates for customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Comment Blacklist Updater: Missing AuthorizationCVE-2023-44147 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through <= 1.1.0.
Product
Comment Blacklist Updater
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Comment Blacklist Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 8, 2024WP Umbrella: Update Backup Restore & Monitoring: Local File InclusionCVE-2024-12209 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename' parameter of the 'umbrella-restore' action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
WP Umbrella: Update Backup Restore & Monitoring
Affected
up to 2.17.0
What to do
Affects up to 2.17.0. Update WP Umbrella: Update Backup Restore & Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 23, 2024AutoListicle: Automatically Update Numbered List Articles: Stored Cross-Site ScriptingCVE-2024-11426 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AutoListicle: Automatically Update Numbered List Articles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-list-number' shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AutoListicle: Automatically Update Numbered List Articles
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update AutoListicle: Automatically Update Numbered List Articles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Unauthorized profile picture updatesCVE-2024-10528 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a missing capability check on the wp_ajax_um_resize_image() and ajax_resize_image() functions in all versions up to, and including, 2.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the profile pictures of other users.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.8.9
What to do
Affects up to 2.8.9. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Nov 19, 2024UPDATE NOTIFICATIONS: Cross-Site Request Forgery (CSRF)CVE-2024-51653 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in akira1891 UPDATE NOTIFICATIONS update-notifications allows Stored XSS.This issue affects UPDATE NOTIFICATIONS: from n/a through <= 0.3.4.
Product
UPDATE NOTIFICATIONS
Affected
up to 0.3.4
What to do
Affects up to 0.3.4. Update UPDATE NOTIFICATIONS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024Elfsight Telegram Chat CC: Unauthorized modification of data to a missing capability check on the 'updatePreferences' functionCVE-2024-10390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences' function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elfsight Telegram Chat CC
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Elfsight Telegram Chat CC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized API key updateCVE-2023-7289 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytium_sw_save_api_keys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin API keys.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Premium Addons for Elementor: Arbitrary Option UpdatesCVE-2021-4445 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.
Product
Premium Addons for Elementor
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ithemes.com plugins.trac.wordpress.org
Sep 3, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Local File Inclusion, Arbitrary Settings Update, and User CreationCVE-2024-7950 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Attackers can also update arbitrary settings and create user accounts even when registration is disabled, leading to user creation with a default role of Administrator.
Product
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 1, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Unauthorized Malichimp API key updateCVE-2024-5053 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.18
What to do
Affects up to 5.1.18. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2024No Update Nag: Full Path DisclosureCVE-2024-7412 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
No Update Nag
Affected
up to 1.4.12
What to do
Affects up to 1.4.12. Update No Update Nag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 23, 2024Social Auto Poster: Unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ functionCVE-2024-6754 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata.
Product
Social Auto Poster
Affected
up to 5.3.14
What to do
Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 20, 2024Multisite Content Copier/Updater: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Obtain Infotech Multisite Content Copier/Updater allows Reflected XSS.This issue affects Multisite Content Copier/Updater: from n/a through 1.5.0.
Product
Multisite Content Copier/Updater
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Multisite Content Copier/Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 11, 2024Event post: Unauthorized bulk metadata updateCVE-2024-1375 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the save_bulkdatas function in all versions up to, and including, 5.9.10. This makes it possible for unauthenticated attackers to update post_meta_data via a forged request, granted they can trick a logged-in user into performing an action such as clicking on a link.
Product
Event post
Affected
up to 5.9.10
What to do
Affects up to 5.9.10. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer: Unauthorized plugin settings updateCVE-2024-3602 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the disconnect_promolayer function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber access or higher, to remove the Promolayer connection.
Product
Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Materialis: Limited arbitrary options updatesCVE-2023-3204 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companion_disable_popup() function called via an AJAX action. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to modify any option on the site to a numerical value.
Product
Materialis
Affected
up to 1.1.24
What to do
Affects up to 1.1.24. Update Materialis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Jun 12, 2024InstaWP Connect – 1-click WP Staging & Migration: Arbitrary option updatesCVE-2024-4898 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.38
What to do
Affects up to 0.1.0.38. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 11, 2024MJ Update History: Missing AuthorizationCVE-2024-35671 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Minoji MJ Update History.This issue affects MJ Update History: from n/a through 1.0.4.
Product
MJ Update History
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update MJ Update History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 24, 2024Event post: Unauthorized bulk metadata updateCVE-2024-1376 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. This makes it possible for authenticated attackers, with subscriber access or higher, to update post_meta_data.
Product
Event post
Affected
up to 5.9.4
What to do
Affects up to 5.9.4. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2024Brizy – Page Builder: Unauthorized plugin setting updateCVE-2024-3711 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the functions action_request_disable, action_change_template, and action_request_enable in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with contributor access or above, to enable/disable the Brizy editor and modify the template used.
Product
Brizy – Page Builder
Affected
up to 2.4.43
What to do
Affects up to 2.4.43. Update Brizy – Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2024MJ Update History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32543 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Minoji MJ Update History allows Reflected XSS.This issue affects MJ Update History: from n/a through 1.0.4.
Product
MJ Update History
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update MJ Update History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Royal Elementor Addons and Templates: Unauthorized post metadata updateCVE-2024-0516 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_update_form_action_meta function in all versions up to, and including, 1.3.87. This makes it possible for unauthenticated attackers to update certain metadata.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.87
What to do
Affects up to 1.3.87. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels: Unauthorized arbitrary options updateCVE-2024-0869 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the instant-images/license REST API endpoint in all versions up to, and including, 6.1.0. This makes it possible for authors and higher to update arbitrary options. CVE-2024-33569 appears to be a duplicate of this issue.
Product
Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels
Affected
up to 6.1.0
What to do
Affects up to 6.1.0. Update Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Royal Elementor Kit: Unauthorized arbitrary transient updateCVE-2024-0835 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler function in all versions up to, and including, 1.0.116. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to true and not arbitrary values.
Product
Royal Elementor Kit
Affected
up to 1.0.116
What to do
Affects up to 1.0.116. Update Royal Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordpress.org
Feb 5, 2024Cookie Information | Free GDPR Consent Solution: Arbitrary option updatesCVE-2023-6700 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level access or higher, to edit arbitrary site options which can be used to create administrator accounts.
Product
Cookie Information | Free GDPR Consent Solution
Affected
up to 2.0.22
What to do
Affects up to 2.0.22. Update Cookie Information | Free GDPR Consent Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Hostinger: Unauthorized plugin settings updateCVE-2023-6751 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.
Product
Hostinger
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update Hostinger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.