Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,713 results · page 21 of 35

Oct 31, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Insecure Direct Object ReferenceCVE-2024-9700 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the submit_quizzes() function due to missing validation on the 'entry_id' user controlled key. This makes it possible for unauthenticated attackers to modify other user's quiz submissions.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.36.0
What to do
Affects up to 1.36.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2024Beaver Builder – WordPress Page Builder: Stored Cross-Site ScriptingCVE-2024-9505 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Beaver Builder – WordPress Page Builder
Affected
up to 2.8.4.2
What to do
Affects up to 2.8.4.2. Update Beaver Builder – WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 29, 2024Masteriyo LMS – eLearning and Online Course Builder for: Unauthorized user profile modificationCVE-2024-10008 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.
Product
Masteriyo LMS – eLearning and Online Course Builder for
Affected
up to 1.13.3
What to do
Affects up to 1.13.3. Update Masteriyo LMS – eLearning and Online Course Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 29, 2024Masteriyo LMS – eLearning and Online Course Builder for: Stored Cross-Site ScriptingCVE-2024-10000 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with student-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Masteriyo LMS – eLearning and Online Course Builder for
Affected
up to 1.13.3
What to do
Affects up to 1.13.3. Update Masteriyo LMS – eLearning and Online Course Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 28, 2024PDF Generator Addon for Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50449 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Stored XSS.This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through <= 1.7.4.
Product
PDF Generator Addon for Elementor Page Builder
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update PDF Generator Addon for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024Stacks Mobile App Builder: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Product
Stacks Mobile App Builder
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Unauthorized accessCVE-2024-10402 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to create new or edit existing forms, including updating the default registration role to Administrator on User Registration forms.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.35.1
What to do
Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2024App Builder – Create Native Android & iOS Apps On The Flight: Privilege escalationCVE-2024-9302 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verify_otp_forgot_password() and update_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
Product
App Builder – Create Native Android & iOS Apps On The Flight
Affected
up to 5.3.7
What to do
Affects up to 5.3.7. Update App Builder – Create Native Android & iOS Apps On The Flight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2024Extra Product Options Builder for WooCommerce: Stored Cross-Site ScriptingCVE-2024-9214 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'RednaoSerializedFields' parameter during the creation of a signature file in all versions up to, and including, 1.2.133 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Extra Product Options Builder for WooCommerce
Affected
up to 1.2.133
What to do
Affects up to 1.2.133. Update Extra Product Options Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2024Elementor Header & Footer Builder: Information DisclosureCVE-2024-10050 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfe_template shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the contents of Draft, Private and Password-protected posts they do not own.
Product
Elementor Header & Footer Builder
Affected
up to 1.6.43
What to do
Affects up to 1.6.43. Update Elementor Header & Footer Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2024Photo Gallery Builder: Missing AuthorizationCVE-2024-49325 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdiscover Photo Gallery Builder photo-gallery-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Photo Gallery Builder: from n/a through <= 3.0.
Product
Photo Gallery Builder
Affected
up to 3.0
What to do
Affects up to 3.0. Update Photo Gallery Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024SiteBuilder Dynamic Components: Deserialization of Untrusted DataCVE-2024-49625 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in sphoid SiteBuilder Dynamic Components sitebuilder-dynamic-components allows Object Injection.This issue affects SiteBuilder Dynamic Components: from n/a through <= 1.0.
Product
SiteBuilder Dynamic Components
Affected
up to 1.0
What to do
Affects up to 1.0. Update SiteBuilder Dynamic Components to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Mighty Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mighty Plugins Mighty Builder mighty-builder allows Stored XSS.This issue affects Mighty Builder: from n/a through <= 1.0.2.
Product
Mighty Builder
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Mighty Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024wpPricing Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49225 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in swebdeveloper wpPricing Builder wppricing-builder-lite-responsive-pricing-table-builder allows Stored XSS.This issue affects wpPricing Builder: from n/a through <= 1.5.0.
Product
wpPricing Builder
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update wpPricing Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024WordPress Portfolio Builder – Portfolio Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49302 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gallery uber-grid allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: from n/a through <= 1.1.7.
Product
WordPress Portfolio Builder – Portfolio Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9352 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possible for unauthenticated attackers to create draft forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.35.1
What to do
Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9351 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for unauthenticated attackers to create draft quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.35.1
What to do
Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024The WP Popup Builder – Popup Forms and Marketing Lead Generation: Arbitrary shortcode executionCVE-2024-9061 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. NOTE: This vulnerability was partially fixed in version 1.3.5 with a nonce check, which effectively prevented access to the affected function. However, version 1.3.6 incorporates the correct authorization check to prevent unauthorized access.
Product
The WP Popup Builder – Popup Forms and Marketing Lead Generation
Affected
up to 1.3.5
Fixed in
1.3.5
What to do
Update The WP Popup Builder – Popup Forms and Marketing Lead Generation to 1.3.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Formidable Form Builder: Sensitive Data ExposureCVE-2017-20194 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.
Product
Formidable Form Builder
Affected
up to 2.05.03
What to do
Affects up to 2.05.03. Update Formidable Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record klikki.fi wordfence.com
Oct 16, 2024Formidable Form Builder: Stored Cross-Site ScriptingCVE-2017-20192 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
Product
Formidable Form Builder
Fixed in
2.05.03
What to do
Update Formidable Form Builder to 2.05.03 or newer.
Full record and what to do →NVD record klikki.fi wordpress.org
Oct 14, 2024Elementor Website Builder – More than Just a Page Builder: Basic Information ExposureCVE-2024-6757 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the get_image_alt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract either excerpt data or titles of private or password-protected posts.
Product
Elementor Website Builder – More than Just a Page Builder
Affected
up to 3.23.5
What to do
Affects up to 3.23.5. Update Elementor Website Builder – More than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2024Stackable – Page Builder Gutenberg Blocks: CSS InjectionCVE-2024-8760 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don't perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users.
Product
Stackable – Page Builder Gutenberg Blocks
Affected
up to 3.13.6
What to do
Affects up to 3.13.6. Update Stackable – Page Builder Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2024Mynx Page Builder: Stored Cross-Site ScriptingCVE-2024-9656 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mynx Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Mynx Page Builder
Affected
up to 0.27.8
What to do
Affects up to 0.27.8. Update Mynx Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 11, 2024BlockMeister – Block Pattern Builder: Reflected Cross-Site ScriptingCVE-2024-9616 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BlockMeister – Block Pattern Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
BlockMeister – Block Pattern Builder
Affected
up to 3.1.10
What to do
Affects up to 3.1.10. Update BlockMeister – Block Pattern Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Arbitrary file readCVE-2024-9507 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.15.2 due to improper input validation within the iconUpload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to leverage a PHP filter chain attack and read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
Affected
up to 2.15.2
What to do
Affects up to 2.15.2. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor: Arbitrary file uploadsCVE-2024-9234 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.
Product
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 9, 2024WP Builder: Stored Cross-Site ScriptingCVE-2024-9457 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Builder
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update WP Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 6, 2024Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47298 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.1.1.
Product
Bold Page Builder
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024XLTab – Accordions and Tabs for Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon XLTab – Accordions and Tabs for Elementor Page Builder xl-tab allows Stored XSS.This issue affects XLTab – Accordions and Tabs for Elementor Page Builder: from n/a through <= 1.3.
Product
XLTab – Accordions and Tabs for Elementor Page Builder
Affected
up to 1.3
What to do
Affects up to 1.3. Update XLTab – Accordions and Tabs for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47391 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through < 5.1.1.
Product
Bold Page Builder
Fixed in
5.1.1
What to do
Update Bold Page Builder to 5.1.1 or newer.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Hash Form – Drag & Drop Form Builder: Limited file uploadsCVE-2024-9417 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.
Product
Hash Form – Drag & Drop Form Builder
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Hash Form – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-9528 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.19
What to do
Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Themify Builder: Reflected Cross-Site ScriptingCVE-2024-9385 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Themify Builder
Affected
up to 7.6.2
What to do
Affects up to 7.6.2. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2024Ibtana – WordPress Website Builder: Stored Cross-Site ScriptingCVE-2024-8282 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:ive/ive-productscarousel' Gutenberg block in all versions up to, and including, 1.2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ibtana – WordPress Website Builder
Affected
up to 1.2.4.4
What to do
Affects up to 1.2.4.4. Update Ibtana – WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2024Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid: Reflected Cross-Site ScriptingCVE-2024-9218 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
Affected
up to 1.3.14
What to do
Affects up to 1.3.14. Update Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2024Elastik Page Builder: Stored Cross-Site ScriptingCVE-2024-9274 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elastik Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Elastik Page Builder
Affected
up to 0.27.4
What to do
Affects up to 0.27.4. Update Elastik Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 30, 2024Cost Calculator Builder: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-8379 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
Product
Cost Calculator Builder
Fixed in
3.2.29
What to do
Update Cost Calculator Builder to 3.2.29 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2024Beaver Builder – WordPress Page Builder: Stored Cross-Site ScriptingCVE-2024-9049 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group module in all versions up to, and including, 2.8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Beaver Builder – WordPress Page Builder
Affected
up to 2.8.3.6
What to do
Affects up to 2.8.3.6. Update Beaver Builder – WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 26, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Stored Cross-Site ScriptingCVE-2024-8633 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.27
What to do
Affects up to 1.15.27. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 25, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-8668 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tooltip and countdown functionality in all versions up to, and including, 2.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)
Affected
up to 2.9.7
What to do
Affects up to 2.9.7. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2024The Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) plugin for WordPress is vulnerablCVE-2024-9069 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 17, 2024The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43977 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.
Product
The Plus Addons for Elementor Page Builder Lite
Affected
up to 5.6.2
What to do
Affects up to 5.6.2. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 13, 2024Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-8742 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Avada | Website Builder For WordPress & eCommerce: Stored Cross-Site ScriptingCVE-2024-5628 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Avada | Website Builder For WordPress & eCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusion_button shortcode in all versions up to, and including, 3.11.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in 3.11.9. Additional hardening for alternate attack vectors was added to version 3.11.10.
Product
Avada | Website Builder For WordPress & eCommerce
Affected
up to 3.11.9
Fixed in
3.11.9
What to do
Update Avada | Website Builder For WordPress & eCommerce to 3.11.9 or newer.
Full record and what to do →NVD record avada.com avada.com
Sep 11, 2024Elementor Website Builder – More than Just a Page Builder: Stored Cross-Site ScriptingCVE-2024-5416 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in Elementor Editor pages. This was partially patched in version 3.23.2.
Product
Elementor Website Builder – More than Just a Page Builder
Affected
up to 3.23.4
What to do
Affects up to 3.23.4. Update Elementor Website Builder – More than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-8440 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2024Cost Calculator Builder PRO: Price manipulationCVE-2024-6010 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.
Product
Cost Calculator Builder PRO
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Cost Calculator Builder PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com plugins.trac.wordpress.org
Sep 6, 2024Enter Addons – Ultimate Template Builder for Elementor: Stored Cross-Site ScriptingCVE-2024-7611 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Enter Addons – Ultimate Template Builder for Elementor
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Enter Addons – Ultimate Template Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site ImportsCVE-2024-8325 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the ‘blockspare_render_social_sharing_block’ function in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 1, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Unauthorized Malichimp API key updateCVE-2024-5053 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.18
What to do
Affects up to 5.1.18. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.