Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

101 results · page 2 of 3

Feb 25, 2025WPPizza: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26991 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ollybach WPPizza wppizza allows Reflected XSS.This issue affects WPPizza: from n/a through <= 3.19.4.
Product
WPPizza
Affected
up to 3.19.4
What to do
Affects up to 3.19.4. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2025Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily: Stored Cross-Site ScriptingCVE-2024-12522 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yayforms' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 13, 2025Puzzles: Stored Cross-Site ScriptingCVE-2025-0837 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Puzzles
Affected
up to 4.2.6
What to do
Affects up to 4.2.6. Update Puzzles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 13, 2025Puzzles | WP Magazine / Review with Store WordPress Theme + RTL: PHP Object InjectionCVE-2024-13770 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of untrusted input 'view_more_posts' AJAX action. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The developer opted to remove the software from the repository, so an update is not available and it is recommended to find a replacement software.
Product
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL
Affected
up to 4.2.4
What to do
Affects up to 4.2.4. Update Puzzles | WP Magazine / Review with Store WordPress Theme + RTL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 12, 2025Puzzles | WP Magazine / Review with Store WordPress Theme + RTL: Stored Cross-Site ScriptingCVE-2024-13769 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'theme_options_ajax_post_action' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and inject malicious web scripts. The developer opted to remove the software from the repository, so an update is not available and it is recommended to find a replacement software.
Product
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL
Affected
up to 4.2.4
What to do
Affects up to 4.2.4. Update Puzzles | WP Magazine / Review with Store WordPress Theme + RTL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 7, 2025Fyrebox Quizzes: Cross-Site Request Forgery (CSRF)CVE-2025-25125 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.
Product
Fyrebox Quizzes
Affected
up to 3.1
What to do
Affects up to 3.1. Update Fyrebox Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 5, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Sensitive Information ExposureCVE-2024-13829 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.0.8 via the 'attachments.php' file. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via forms.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.8
What to do
Affects up to 8.0.8. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2025SC Simple Zazzle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23733 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sayoko SC Simple Zazzle sc-simple-zazzle allows Reflected XSS.This issue affects SC Simple Zazzle: from n/a through <= 1.1.6.
Product
SC Simple Zazzle
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update SC Simple Zazzle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025University Quizzes Online: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oleksandr87 University Quizzes Online university-quizzes-online allows Reflected XSS.This issue affects University Quizzes Online: from n/a through <= 1.4.
Product
University Quizzes Online
Affected
up to 1.4
What to do
Affects up to 1.4. Update University Quizzes Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 18, 2025Buzz Club – Night Club, DJ and Music Festival Event: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-0515 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Product
Buzz Club – Night Club, DJ and Music Festival Event
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Buzz Club – Night Club, DJ and Music Festival Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jan 16, 2025CNZZ&51LA for: Cross-Site Request Forgery (CSRF)CVE-2025-23823 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jprintf CNZZ&51LA for WordPress cnzz51la-for-wordpress allows Cross Site Request Forgery.This issue affects CNZZ&51LA for WordPress: from n/a through <= 1.0.1.
Product
CNZZ&51LA for
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update CNZZ&51LA for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22295 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through <= 8.0.6.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.6
What to do
Affects up to 8.0.6. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 17, 2024LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Arbitrary post deletionCVE-2024-12596 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024Blogger Buzz: Missing AuthorizationCVE-2023-30476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.
Product
Blogger Buzz
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 2, 2024Blizzard Quotes: Cross-Site Request Forgery (CSRF)CVE-2024-53729 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Blizzard Quotes blizzard-quotes allows Stored XSS.This issue affects Blizzard Quotes: from n/a through <= 1.3.
Product
Blizzard Quotes
Affected
up to 1.3
What to do
Affects up to 1.3. Update Blizzard Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 23, 2024Chessgame Shizzle: Reflected Cross-Site ScriptingCVE-2024-11446 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chessgame Shizzle plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'cs_nonce' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chessgame Shizzle
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Chessgame Shizzle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024Azz Anonim Posting: Unrestricted Upload of File with Dangerous TypeCVE-2024-49257 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting azz-anonim-posting allows Upload a Web Shell to a Web Server.This issue affects Azz Anonim Posting: from n/a through <= 0.9.
Product
Azz Anonim Posting
Affected
up to 0.9
What to do
Affects up to 0.9. Update Azz Anonim Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 6, 2024LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Blind SQL InjectionCVE-2024-7349 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Affected
up to 7.7.5
What to do
Affects up to 7.7.5. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 3, 2024Quiz and Survey Master (QSM): Does not properly sanitise and escape some of its Quizz settingsCVE-2024-6390 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Product
Quiz and Survey Master (QSM)
Fixed in
9.1.0
What to do
Update Quiz and Survey Master (QSM) to 9.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jun 21, 2024WPPizza: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35766 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ollybach WPPizza allows Reflected XSS.This issue affects WPPizza: from n/a through 3.18.13.
Product
WPPizza
Affected
up to 3.18.13
What to do
Affects up to 3.18.13. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Whizzy: Missing AuthorizationCVE-2024-30544 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in UPQODE Whizzy.This issue affects Whizzy: from n/a through 1.1.18.
Product
Whizzy
Affected
up to 1.1.18
What to do
Affects up to 1.1.18. Update Whizzy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Forms Puzzle Captcha: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
Product
WP Forms Puzzle Captcha
Affected
up to 4.1
What to do
Affects up to 4.1. Update WP Forms Puzzle Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Brozzme Scroll Top: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34426 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benoti Brozzme Scroll Top allows Stored XSS.This issue affects Brozzme Scroll Top: from n/a through 1.8.5.
Product
Brozzme Scroll Top
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Brozzme Scroll Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024WPPizza: Missing AuthorizationCVE-2024-33576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10.
Product
WPPizza
Affected
up to 3.18.10
What to do
Affects up to 3.18.10. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Whizzy: Authorization Bypass Through User-Controlled KeyCVE-2024-30543 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.
Product
Whizzy
Affected
up to 1.1.18
What to do
Affects up to 1.1.18. Update Whizzy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Coming Soon, Under Construction & Maintenance Mode By Dazzler: Maintenance mode bypassCVE-2024-1181 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Coming Soon, Under Construction & Maintenance Mode By Dazzler plugin for WordPress is vulnerable to maintenance mode bypass in all versions up to, and including, 2.1.2. This is due to the plugin relying on the REQUEST_URI to determine if the page being accesses is an admin area. This makes it possible for unauthenticated attackers to bypass maintenance mode and access the site which may be considered confidential when in maintenance mode.
Product
Coming Soon, Under Construction & Maintenance Mode By Dazzler
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Coming Soon, Under Construction & Maintenance Mode By Dazzler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2024Sensei LMS – Online Courses, Quizzes, & Learning: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50875 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0.
Product
Sensei LMS – Online Courses, Quizzes, & Learning
Affected
up to 4.17.0
What to do
Affects up to 4.17.0. Update Sensei LMS – Online Courses, Quizzes, & Learning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023ARI Stream Quiz – WordPress Quizzes Builder: Deserialization of Untrusted DataCVE-2023-52182 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes Builder: from n/a through 1.3.0.
Product
ARI Stream Quiz – WordPress Quizzes Builder
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update ARI Stream Quiz – WordPress Quizzes Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023WP Forms Puzzle Captcha: Cross-Site Request Forgery (CSRF)CVE-2023-48278 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Stored XSS.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
Product
WP Forms Puzzle Captcha
Affected
up to 4.1
What to do
Affects up to 4.1. Update WP Forms Puzzle Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugiCVE-2023-47835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.2.32 versions.
Affected
up to 1.2.32
What to do
Affects up to 1.2.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <= 3.3CVE-2023-47755 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <= 3.3.5 versions.
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Jazz Popups: Cross-Site Request Forgery (CSRF)CVE-2023-32966 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through 1.8.7.
Product
Jazz Popups
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update Jazz Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 30, 2023Buzzsprout Podcasting: Stored Cross-Site ScriptingCVE-2023-5335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Buzzsprout Podcasting
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Buzzsprout Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha plugin <= 4.1 versions.CVE-2023-44997 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha plugin <= 4.1 versions.
Affected
up to 4.1
What to do
Affects up to 4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szálCVE-2022-41685 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.
Affected
up to 5.6.3.2
What to do
Affects up to 5.6.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 10, 2022The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & GraCVE-2022-3154 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license
Fixed in
4.4.5.4
What to do
Update the plugin to 4.4.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 21, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress.CVE-2022-36383 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress.
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 9, 2022Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin <= 2.0.1 at WordPress.CVE-2022-37335 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin <= 2.0.1 at WordPress.
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 6, 2022Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.CVE-2022-36387 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2022-27854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher role via &wpt_test_page_submit_button_caption parameter.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2021-36867 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher user rights.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 8, 2021Qwizcards – online quizzes and flashcards: Does not properly sanitize and escape some of its settingsCVE-2021-24706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Qwizcards – online quizzes and flashcards
Fixed in
3.62
What to do
Update Qwizcards – online quizzes and flashcards to 3.62 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Coming Soon, Under Construction & Maintenance Mode By Dazzler: Does not sanitise or escape its description settingCVE-2021-24539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
Coming Soon, Under Construction & Maintenance Mode By Dazzler
Fixed in
1.6.7
What to do
Update Coming Soon, Under Construction & Maintenance Mode By Dazzler to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 10, 2020controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via tCVE-2018-14502 · WordPress plugins & themes · reported by MITRECritical 9.8
controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.
Product
controllers/quizzes.php in the Kiboko Chained Quiz
Fixed in
1.0.9
What to do
Update controllers/quizzes.php in the Kiboko Chained Quiz to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.CVE-2015-9418 · WordPress plugins & themes · reported by MITREMedium 4.3
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.
Product
Watu Pro
Fixed in
4.9.0.8
What to do
Update Watu Pro to 4.9.0.8 or newer.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Jul 21, 2019An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress.CVE-2019-14231 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.
Product
An issue was discovered in the Viral Quiz Maker - OnionBuzz
Fixed in
1.2.2
What to do
Update An issue was discovered in the Viral Quiz Maker - OnionBuzz to 1.2.2 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Jul 21, 2019An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress.CVE-2019-14230 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.
Product
An issue was discovered in the Viral Quiz Maker - OnionBuzz
Fixed in
1.2.7
What to do
Update An issue was discovered in the Viral Quiz Maker - OnionBuzz to 1.2.7 or newer.
Full record and what to do →NVD record openwall.com openwall.com
Oct 3, 2018The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.CVE-2018-17947 · WordPress plugins & themes · reported by MITREMedium 6.1
The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.
Product
Snazzy Maps
Fixed in
1.1.5
What to do
Update Snazzy Maps to 1.1.5 or newer.
Full record and what to do →NVD record defensecode.com seclists.org
Apr 24, 2017There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.CVE-2017-8099 · WordPress plugins & themes · reported by MITREHigh 8.1
There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request.
Product
There is CSRF in the WHIZZ
Fixed in
1.1.1
What to do
Update There is CSRF in the WHIZZ to 1.1.1 or newer.
Full record and what to do →NVD record seclists.org plugins.trac.wordpress.org
Oct 10, 2016Reflected XSS in wordpress plugin whizz v1.0.7CVE-2016-1000154 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin whizz v1.0.7
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.