Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

2,981 results · page 20 of 60

Oct 28, 2024Premium SEO Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50465 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP SEO – Calin Vingan Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 1.6.001.
Product
Premium SEO Pack
Affected
up to 1.6.001
What to do
Affects up to 1.6.001. Update Premium SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024Stacks Mobile App Builder: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Product
Stacks Mobile App Builder
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024All-in-One WP Migration and Backup: Arbitrary PHP Code InjectionCVE-2024-9162 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, with Administrator-level access and above, to create an export file with the .php extension on the affected site's server, adding an arbitrary PHP code to it, which may make remote code execution possible.
Product
All-in-One WP Migration and Backup
Affected
up to 7.86
What to do
Affects up to 7.86. Update All-in-One WP Migration and Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 23, 2024Backup and Staging by WP Time Capsule: Deserialization of Untrusted DataCVE-2024-49684 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.21
What to do
Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2024All-in-One WP Migration and Backup: Sensitive Information ExposureCVE-2024-8852 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full paths contained in the exposed log files.
Product
All-in-One WP Migration and Backup
Affected
up to 7.86
What to do
Affects up to 7.86. Update All-in-One WP Migration and Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2024Back Link Tracker: Cross-Site Request Forgery (CSRF)CVE-2024-49617 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in anciwasim Back Link Tracker back-link-tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through <= 1.0.0.
Product
Back Link Tracker
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Back Link Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Nice Backgrounds: Unrestricted Upload of File with Dangerous TypeCVE-2024-49330 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds nicebackgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through <= 1.0.
Product
Nice Backgrounds
Affected
up to 1.0
What to do
Affects up to 1.0. Update Nice Backgrounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024Mitm Bug Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49224 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mahesh_9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through <= 1.0.
Product
Mitm Bug Tracker
Affected
up to 1.0
What to do
Affects up to 1.0. Update Mitm Bug Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Keep Backup Daily: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-48024 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Retrieve Embedded Sensitive Data.This issue affects Keep Backup Daily: from n/a through <= 2.1.3.
Product
Keep Backup Daily
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Logo Slider: Does not validate and escape some of its Slider Settings before outputting them back in attributesCVE-2024-5429 · WordPress plugins & themes · reported by WPScanHigh 7.6
The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Logo Slider
Fixed in
4.1.0
What to do
Update Logo Slider to 4.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2024Migration, Backup, Staging – WPvivid: Arbitrary file uploadsCVE-2020-36842 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently extracted. This affects versions up to, and including 0.9.35.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.35
What to do
Affects up to 0.9.35. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org webarxsecurity.com
Oct 16, 2024File Manager Pro: Arbitrary backup file downloads and uploadsCVE-2024-8746 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024Migration, Backup, Staging – WPvivid: Sensitive information disclosure of a WordPress site's databaseCVE-2020-36835 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing capability checks on the wp_ajax_wpvivid_add_remote AJAX action that allows low-level authenticated attackers to send back-ups to a remote location of their choice for review. This affects versions up to, and including 0.9.35.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.35
What to do
Affects up to 0.9.35. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org webarxsecurity.com
Oct 12, 2024Stackable – Page Builder Gutenberg Blocks: CSS InjectionCVE-2024-8760 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don't perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users.
Product
Stackable – Page Builder Gutenberg Blocks
Affected
up to 3.13.6
What to do
Affects up to 3.13.6. Update Stackable – Page Builder Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 11, 2024Talkback: Deserialization of Untrusted DataCVE-2024-48033 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkback: from n/a through <= 1.0.
Product
Talkback
Affected
up to 1.0
What to do
Affects up to 1.0. Update Talkback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2024Backup and Staging by WP Time Capsule: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-48020 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.21
What to do
Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2024TI WooCommerce Wishlist: Is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL queryCVE-2024-9156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
TI WooCommerce Wishlist
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 5, 2024BSK Forms Blacklist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47624 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Blacklist bsk-gravityforms-blacklist allows Reflected XSS.This issue affects BSK Forms Blacklist: from n/a through <= 3.8.1.
Product
BSK Forms Blacklist
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47392 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through <= 5.7.5.
Product
Element Pack Elementor Addons
Affected
up to 5.7.5
What to do
Affects up to 5.7.5. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024The Pack Elementor addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47383 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.0.8.8.
Product
The Pack Elementor addons
Affected
up to 2.0.8.8
What to do
Affects up to 2.0.8.8. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 2, 2024Migration, Backup, Staging: Does not use sufficient randomness in the filename that is createdCVE-2024-7315 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups.
Product
Migration, Backup, Staging
Fixed in
0.9.106
What to do
Update Migration, Backup, Staging to 0.9.106 or newer.
Full record and what to do →NVD record wpscan.com
Sep 30, 2024Ultimate Blocks: Does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embedCVE-2024-8536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Ultimate Blocks
Fixed in
3.2.2
What to do
Update Ultimate Blocks to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2024AI ChatBot with ChatGPT and Content Generator by AYS: Lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2CVE-2024-7714 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and 'ays_chatgpt_save_feedback'
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Fixed in
2.1.0
What to do
Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 26, 2024Contact Form 7 Math Captcha: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6517 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users.
Product
Contact Form 7 Math Captcha
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Contact Form 7 Math Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 25, 2024The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce creditCVE-2024-8658 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database.
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2024Beam me up Scotty – Back to Top Button: Reflected Cross-Site ScriptingCVE-2024-8741 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Beam me up Scotty – Back to Top Button
Affected
up to 1.0.21
What to do
Affects up to 1.0.21. Update Beam me up Scotty – Back to Top Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2024Premium Packages – Sell Digital Products Securely: Cross-Site Request ForgeryCVE-2024-7386 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.1. This is due to missing nonce validation on the addRefund() function. This makes it possible for unauthenticated attackers to perform actions such as initiating refunds via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
Product
Premium Packages – Sell Digital Products Securely
Affected
up to 5.9.1
What to do
Affects up to 5.9.1. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 23, 2024Garden Gnome Package: Stored Cross-Site ScriptingCVE-2024-8657 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ggpkg shortcode in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Garden Gnome Package
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update Garden Gnome Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2024Arni Cinco WPCargo Track & Trace wpcargo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-44004 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.
Product
Arni Cinco WPCargo Track & Trace wpcargo
Fixed in
8.0.4
What to do
Update Arni Cinco WPCargo Track & Trace wpcargo to 8.0.4 or newer.
Full record and what to do →NVD record patchstack.com
Sep 14, 2024Waitlist Woocommerce ( Back in stock notifier ): Reflected Cross-Site ScriptingCVE-2024-8724 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Waitlist Woocommerce ( Back in stock notifier )
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update Waitlist Woocommerce ( Back in stock notifier ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 14, 2024Backuply – Backup, Restore, Migrate and Clone: SQL InjectionCVE-2024-8669 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to the backuply_wp_clone_sql() function in all versions up to, and including, 1.3.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Backuply – Backup, Restore, Migrate and Clone
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Backuply – Backup, Restore, Migrate and Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not validate and escape some of its settings before outputting them back in the pageCVE-2024-7133 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputting them back in the page, which could allow users with a high role to perform Stored Cross-Site Scripting attacks.
Product
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
Fixed in
2.7.3
What to do
Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024MM-Breaking News: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-8056 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
MM-Breaking News
Affected
up to 0.7.9
What to do
Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024Music Request Manager: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6018 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
Music Request Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 11, 2024Advanced WordPress Backgrounds: Stored Cross-Site ScriptingCVE-2024-8045 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced WordPress Backgrounds
Affected
up to 1.12.3
What to do
Affects up to 1.12.3. Update Advanced WordPress Backgrounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2024Snapshot Backup: Does not have CSRF check in some placesCVE-2024-7689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Snapshot Backup
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Snapshot Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 8, 2024WP MultiTasking: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6859 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP MultiTasking
Affected
up to 0.1.12
What to do
Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 2, 2024Flaming Forms: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-7692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Flaming Forms
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 2, 2024Ninja Forms: Does not escape an URL before outputting it back in an attributeCVE-2024-7354 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ninja Forms
Fixed in
3.8.11
What to do
Update Ninja Forms to 3.8.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2024NitroPack: Improper Control of Generation of Code ('Code Injection')CVE-2024-43922 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Improper Control of Generation of Code ('Code Injection') vulnerability in NitroPack Inc. NitroPack allows Code Injection.This issue affects NitroPack: from n/a through 1.16.7.
Product
NitroPack
Affected
up to 1.16.7
What to do
Affects up to 1.16.7. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Premium SEO Pack – WP SEO: Sensitive Information ExposureCVE-2024-3679 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.002. This makes it possible for unauthenticated attackers to view limited information from password protected posts through the social meta data.
Product
Premium SEO Pack – WP SEO
Affected
up to 1.6.002
What to do
Affects up to 1.6.002. Update Premium SEO Pack – WP SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 29, 2024Gutentor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-5417 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutentor
Fixed in
3.3.6
What to do
Update Gutentor to 3.3.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2024Backup and Restore: Cross-Site Request Forgery (CSRF)CVE-2024-43269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPBackItUp Backup and Restore WordPress.This issue affects Backup and Restore WordPress: from n/a through 1.50.
Product
Backup and Restore
Affected
up to 1.50
What to do
Affects up to 1.50. Update Backup and Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Shield Security: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-7313 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Shield Security
Fixed in
20.0.6
What to do
Update Shield Security to 20.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2024LiquidPoll – Polls, Surveys, NPS and Feedback Reviews: Stored Cross-Site ScriptingCVE-2024-7134 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘form_data’ parameter in all versions up to, and including, 3.3.78 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LiquidPoll – Polls, Surveys, NPS and Feedback Reviews
Affected
up to 3.3.78
What to do
Affects up to 3.3.78. Update LiquidPoll – Polls, Surveys, NPS and Feedback Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 19, 2024GEO my WP: Does not prevent unauthenticated attackers from including arbitrary files in PHP's execution contextCVE-2024-6330 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.
Product
GEO my WP
Fixed in
4.5.0.2
What to do
Update GEO my WP to 4.5.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2024PowerPack for Beaver Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43330 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack for Beaver Builder allows Reflected XSS.This issue affects PowerPack for Beaver Builder: from n/a before 2.37.4.
Product
PowerPack for Beaver Builder
Fixed in
2.37.4
What to do
Update PowerPack for Beaver Builder to 2.37.4 or newer.
Full record and what to do →NVD record patchstack.com
Aug 17, 2024BackWPup: Directory TraversalCVE-2023-5505 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.
Product
BackWPup
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update BackWPup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2024Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows): Stored Cross-Site ScriptingCVE-2024-7247 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Gallery and Countdown widgets in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2024BSK Forms Blacklist: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43233 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky BSK Forms Blacklist allows Reflected XSS.This issue affects BSK Forms Blacklist: from n/a through 3.8.
Product
BSK Forms Blacklist
Affected
up to 3.8
What to do
Affects up to 3.8. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.