Updated 36 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,238 results · page 21 of 25

Feb 8, 2024Simple Page Access Restriction: Sensitive Information ExposureCVE-2024-0965 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's page restriction and view page content.
Product
Simple Page Access Restriction
Affected
up to 1.0.21
What to do
Affects up to 1.0.21. Update Simple Page Access Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2024Podlove Podcast Publisher: Unauthorized access of dataCVE-2024-1109 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information.
Product
Podlove Podcast Publisher
Affected
up to 4.0.11
What to do
Affects up to 4.0.11. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 7, 2024Quiz Maker: Unauthorized access of dataCVE-2024-1079 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() function in all versions up to, and including, 6.5.2.4. This makes it possible for unauthenticated attackers to fetch arbitrary quiz results which can contain PII.
Product
Quiz Maker
Affected
up to 6.5.2.4
What to do
Affects up to 6.5.2.4. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Advanced Forms for ACF: Unauthorized access of dataCVE-2024-1121 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_json_file() function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings.
Product
Advanced Forms for ACF
Affected
up to 1.9.3.2
What to do
Affects up to 1.9.3.2. Update Advanced Forms for ACF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Unauthorized access of functionalityCVE-2024-0797 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 1.0.6.1. This makes it possible for subscribers and higher to execute functions intended for admin use.
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Affected
up to 1.0.6.1
What to do
Affects up to 1.0.6.1. Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Unauthorized access, modification or loss of dataCVE-2024-0791 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions in all versions up to, and including, 1.0.8.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create, delete or modify taxonomy terms.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized access of dataCVE-2024-0372 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_form_fields' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to create form views.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024WPvivid: Unauthorized access of dataCVE-2023-4637 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_restore_progress() function in versions up to, and including, 0.9.94. This makes it possible for unauthenticated attackers to invoke these functions and obtain full file paths if they have access to a back-up ID.
Product
WPvivid
Affected
up to 0.9.94
What to do
Affects up to 0.9.94. Update WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 1, 2024Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 29, 2024The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which providesCVE-2023-7204 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides
Product
WP STAGING WordPress Backup
Fixed in
3.2.0
What to do
Update WP STAGING WordPress Backup to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 22, 2024Import any XML or CSV File to: Accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file typeCVE-2023-7082 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.
Product
Import any XML or CSV File to
Fixed in
3.7.3
What to do
Update Import any XML or CSV File to to 3.7.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 20, 2024ColorMag: Unauthorized accessCVE-2024-0679 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate arbitrary plugins.
Product
ColorMag
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update ColorMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Jan 16, 2024Royal Elementor Addons and Templates: Does not ensure that users accessing posts via an AJAX action (and REST endpointCVE-2023-5922 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content
Product
Royal Elementor Addons and Templates
Fixed in
1.3.81
What to do
Update Royal Elementor Addons and Templates to 1.3.81 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 11, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Unauthorized access of data and modification of dataCVE-2023-6875 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.
Product
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Unauthorized access of dataCVE-2023-6504 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.10.7
What to do
Affects up to 3.10.7. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Export WP Page to Static HTML/CSS: Unauthorized access of data and modification of dataCVE-2023-6369 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose sensitive information or perform unauthorized actions, such as saving advanced plugin settings.
Product
Export WP Page to Static HTML/CSS
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Backup Migration: Unauthorized access of dataCVE-2023-6266 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more.
Product
Backup Migration
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Unauthorized access of dataCVE-2023-7068 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 1, 2024PayHere Payment Gateway: Automatically creates publicly-accessible log files containing sensitive informationCVE-2023-6064 · WordPress plugins & themes · reported by WPScanHigh 7.5
The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur.
Product
PayHere Payment Gateway
Fixed in
2.2.12
What to do
Update PayHere Payment Gateway to 2.2.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51675 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.15
What to do
Affects up to 6.9.15. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Slider: Does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the requestCVE-2023-6077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
Product
Slider
Fixed in
3.5.12
What to do
Update Slider to 3.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Quttera Web Malware Scanner: Doesn't restrict access to detailed scan logsCVE-2023-6065 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code
Product
Quttera Web Malware Scanner
Fixed in
3.4.2.1
What to do
Update Quttera Web Malware Scanner to 3.4.2.1 or newer.
Full record and what to do →NVD record drive.google.com wpscan.com
Dec 18, 2023SmartCrawl: Does not prevent unauthorised users from accessing password-protected posts' contentCVE-2023-5949 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
Product
SmartCrawl
Fixed in
3.8.3
What to do
Update SmartCrawl to 3.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5714 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_db_specs() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve data key specs.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5713 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5712 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_global_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive global value information.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5711 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2023System Dashboard: Unauthorized access of dataCVE-2023-5710 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials.
Product
System Dashboard
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2023UserPro: Unauthorized access of data, modification of data, loss of dataCVE-2023-6007 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.1.1. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.
Product
UserPro
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 22, 2023WP EXtra: Unauthorized access to restricted functionalityCVE-2023-5314 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to send emails with arbitrary content to arbitrary locations from the affected site's mail server.
Product
WP EXtra
Affected
up to 6.2
What to do
Affects up to 6.2. Update WP EXtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023UserPro: Unauthorized access of dataCVE-2023-2448 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to arbitrary shortcode execution. An attacker can leverage CVE-2023-2446 to get sensitive information via shortcode.
Product
UserPro
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions.CVE-2023-26532 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions.
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions.CVE-2023-26518 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions.
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Accessibility Suite by Online ADA: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-45830 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL Injection.This issue affects Accessibility Suite by Online ADA: from n/a through 4.12.
Product
Accessibility Suite by Online ADA
Affected
up to 4.12
What to do
Affects up to 4.12. Update Accessibility Suite by Online ADA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Accessibility Suite by Online ADA: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-47420 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL Injection.This issue affects Accessibility Suite by Online ADA: from n/a through 4.12.
Product
Accessibility Suite by Online ADA
Affected
up to 4.12
What to do
Affects up to 4.12. Update Accessibility Suite by Online ADA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 3, 2023MStore API: Unauthorized Account Access and Privilege EscalationCVE-2023-3277 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email address.
Product
MStore API
Affected
up to 4.10.7
What to do
Affects up to 4.10.7. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Soisy Pagamento Rateale: Unauthorized access of dataCVE-2023-5132 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata).
Product
Soisy Pagamento Rateale
Affected
up to 6.0.1
What to do
Affects up to 6.0.1. Update Soisy Pagamento Rateale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Fancy Product Designer: Unauthorized access to data and modification of plugin settingsCVE-2021-4335 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account.
Product
Fancy Product Designer
Affected
up to 4.6.9
What to do
Affects up to 4.6.9. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.fancyproductdesigner.com wordfence.com
Oct 16, 2023DoLogin Security: Does not restrict the access of a widget that shows the IPs of failed logins to low privileged usersCVE-2023-4800 · WordPress plugins & themes · reported by WPScanMedium 6.5
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
Product
DoLogin Security
Fixed in
3.7.1
What to do
Update DoLogin Security to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 6, 2023Profile Extra Fields by BestWebSoft: Unauthorized access of dataCVE-2023-4469 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to expose potentially sensitive user data, including data entered into custom fields.
Product
Profile Extra Fields by BestWebSoft
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Profile Extra Fields by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2023WP Mail SMTP Pro: Unauthorized access of dataCVE-2023-3213 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to disclose potentially sensitive email information.
Product
WP Mail SMTP Pro
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update WP Mail SMTP Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmailsmtp.com wordfence.com
Sep 25, 2023Prevent files / folders access: Does not validate files to be uploadedCVE-2023-4238 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.
Product
Prevent files / folders access
Fixed in
2.5.2
What to do
Update Prevent files / folders access to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023FTP Access: Does not have authorisation and CSRF checksCVE-2023-3510 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin will view the settings of the plugin. The attack could also be perform via CSRF against any authenticated user.
Product
FTP Access
Affected
up to 1.0
What to do
Affects up to 1.0. Update FTP Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 31, 2023WooCommerce PDF Invoice Builder: Unauthorized access of dataCVE-2023-4245 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the order id and invoice id.
Product
WooCommerce PDF Invoice Builder
Affected
up to 1.2.89
What to do
Affects up to 1.2.89. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2023User Access Manager: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1601 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.
Product
User Access Manager
Fixed in
2.2.18
What to do
Update User Access Manager to 2.2.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2023WP Remote Users Sync: Unauthorized access of data and addition of dataCVE-2023-4374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber privileges or above, to view logs.
Product
WP Remote Users Sync
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update WP Remote Users Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2023InstaWP Connect: Unauthorized access of data, modification of data and loss of dataCVE-2023-3956 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible for unauthenticated attackers to add, modify or delete post and taxonomy, install, activate or deactivate plugin, change customizer settings, add or modify or delete user including administrator user.
Product
InstaWP Connect
Affected
up to 0.0.9.18
What to do
Affects up to 0.0.9.18. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023Gallery Metabox: Unauthorized access of dataCVE-2023-2562 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to obtain a list of images attached to a post.
Product
Gallery Metabox
Affected
up to 1.5
What to do
Affects up to 1.5. Update Gallery Metabox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 10, 2023Call Now Accessibility Button: Does not sanitise and escape some of its settingsCVE-2023-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Call Now Accessibility Button
Fixed in
1.1
What to do
Update Call Now Accessibility Button to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.