Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,228 results · page 21 of 25

Mar 29, 2024Download Monitor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30501 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.
Product
Download Monitor
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024CRM Perks Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30499 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
Product
CRM Perks Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024CRM Perks Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30498 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
Product
CRM Perks Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024WP Responsive Tabs horizontal vertical and accordion Tabs: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30497 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs: from n/a through 1.1.17.
Product
WP Responsive Tabs horizontal vertical and accordion Tabs
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update WP Responsive Tabs horizontal vertical and accordion Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Element Pack Elementor Addons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30496 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.
Product
Element Pack Elementor Addons
Affected
up to 5.5.3
What to do
Affects up to 5.5.3. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Falang multilanguage: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30495 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faboba Falang multilanguage.This issue affects Falang multilanguage: from n/a through 1.3.47.
Product
Falang multilanguage
Affected
up to 1.3.47
What to do
Affects up to 1.3.47. Update Falang multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024OSS Aliyun: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30494 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 沈唁 OSS Aliyun.This issue affects OSS Aliyun: from n/a through 1.4.10.
Product
OSS Aliyun
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update OSS Aliyun to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024ProfileGrid: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30491 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.
Product
ProfileGrid
Affected
up to 5.7.8
What to do
Affects up to 5.7.8. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024ProfileGrid: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30490 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.
Product
ProfileGrid
Affected
up to 5.7.8
What to do
Affects up to 5.7.8. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Zotpress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30488 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from n/a through <= 7.3.7.
Product
Zotpress
Affected
up to 7.3.7
What to do
Affects up to 7.3.7. Update Zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Media Library Folders: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30486 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.7.
Product
Media Library Folders
Affected
up to 8.1.7
What to do
Affects up to 8.1.7. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024WordPress Announcement & Notification Banner Plugin – Bulletin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30478 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bulletin WordPress Announcement & Notification Banner Plugin – Bulletin.This issue affects WordPress Announcement & Notification Banner Plugin – Bulletin: from n/a through 3.8.5.
Product
WordPress Announcement & Notification Banner Plugin – Bulletin
Affected
up to 3.8.5
What to do
Affects up to 3.8.5. Update WordPress Announcement & Notification Banner Plugin – Bulletin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Hash Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30426 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3.
Product
Hash Elements
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Hash Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30422 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.1.
Product
Elementor Addon Elements
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024WP Testimonials: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25924 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trustindex.Io WP Testimonials.This issue affects WP Testimonials: from n/a through 1.4.3.
Product
WP Testimonials
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update WP Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Fusion Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-39309 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1.
Product
Fusion Builder
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024DecaLog: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30245 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pierre Lannoy DecaLog decalog.This issue affects DecaLog: from n/a through <= 3.9.0.
Product
DecaLog
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update DecaLog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Church Admin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30244 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.
Product
Church Admin
Affected
up to 4.0.27
What to do
Affects up to 4.0.27. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024WordPress Tooltips: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30243 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tomas WordPress Tooltips.This issue affects WordPress Tooltips: from n/a before 9.4.5.
Product
WordPress Tooltips
Fixed in
9.4.5
What to do
Update WordPress Tooltips to 9.4.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Contact Form to Any API: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30242 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions Contact Form to Any API.This issue affects Contact Form to Any API: from n/a through 1.1.8.
Product
Contact Form to Any API
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024ProfileGrid: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30241 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.1.
Product
ProfileGrid
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Calendarista: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30240 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Typps Calendarista.This issue affects Calendarista: from n/a through 15.5.7.
Product
Calendarista
Affected
up to 15.5.7
What to do
Affects up to 15.5.7. Update Calendarista to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Zoho Campaigns: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30239 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.6.
Product
Zoho Campaigns
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Zoho Campaigns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Slider by Supsystic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30237 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Supsystic Slider by Supsystic.This issue affects Slider by Supsystic: from n/a through 1.8.10.
Product
Slider by Supsystic
Affected
up to 1.8.10
What to do
Affects up to 1.8.10. Update Slider by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Contest Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30236 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 21.3.4.
Product
Contest Gallery
Affected
up to 21.3.4
What to do
Affects up to 21.3.4. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-2091 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.13.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addon Elements
Affected
up to 1.13.2
What to do
Affects up to 1.13.2. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 27, 2024Contest Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30238 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 21.3.2.
Product
Contest Gallery
Affected
up to 21.3.2
What to do
Affects up to 21.3.2. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29792 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.93.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.93
What to do
Affects up to 1.5.93. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28787 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.
Product
Quiz And Survey Master
Affected
up to 8.1.4
What to do
Affects up to 8.1.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-23991 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdevelop / Oplugins Booking Calendar allows SQL Injection.This issue affects Booking Calendar: from n/a through 9.4.3.
Product
Booking Calendar
Affected
up to 9.4.3
What to do
Affects up to 9.4.3. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Automatic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-27956 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
Product
Automatic
Affected
up to 3.92.0
What to do
Affects up to 3.92.0. Update Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29107 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.12.10.
Product
Elementor Addon Elements
Affected
up to 1.12.10
What to do
Affects up to 1.12.10. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024ElementsKit Elementor addons: Stored Cross-Site ScriptingCVE-2024-2042 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ElementsKit Elementor addons
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update ElementsKit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2024ElementsKit Elementor addons: Stored Cross-Site ScriptingCVE-2024-1239 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ElementsKit Elementor addons
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update ElementsKit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 15, 2024ElementsKit Elementor addons: Stored Cross-Site ScriptingCVE-2023-6525 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar element attributes in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ElementsKit Elementor addons
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update ElementsKit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-1422 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the modal popup widget's effect setting in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addon Elements
Affected
up to 1.12.12
What to do
Affects up to 1.12.12. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-1393 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content Switcher widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addon Elements
Affected
up to 1.12.12
What to do
Affects up to 1.12.12. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-1392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button1_icon' attribute of the Dual Button widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addon Elements
Affected
up to 1.12.12
What to do
Affects up to 1.12.12. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-1391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eae_custom_overlay_switcher’ attribute of the Thumbnail Slider widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addon Elements
Affected
up to 1.12.12
What to do
Affects up to 1.12.12. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Elementor Addon Elements: Directory TraversalCVE-2024-1358 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on the server, which may expose sensitive information.
Product
Elementor Addon Elements
Affected
up to 1.12.12
What to do
Affects up to 1.12.12. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 2, 2024Ultimate Bootstrap Elements for Elementor: Stored Cross-Site ScriptingCVE-2024-1398 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ and ’heading_sub_title_tag’ parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultimate Bootstrap Elements for Elementor
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Ultimate Bootstrap Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024postMash – custom post order: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25927 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Joel Starnes postMash – custom post order.This issue affects postMash – custom post order: from n/a through 1.2.0.
Product
postMash – custom post order
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update postMash – custom post order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024MoveTo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25910 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.
Product
MoveTo
Affected
up to 6.2
What to do
Affects up to 6.2. Update MoveTo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Malware Scanner: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25902 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Scanner: from n/a through 4.7.2.
Product
Malware Scanner
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update Malware Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024SP Project & Document Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-24868 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69.
Product
SP Project & Document Manager
Affected
up to 4.69
What to do
Affects up to 4.69. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 23, 2024Sitepact: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-25928 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sitepact.This issue affects Sitepact: from n/a through 1.0.5.
Product
Sitepact
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Sitepact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Elementor Addon Elements: Stored Cross-Site ScriptingCVE-2024-0834 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_to parameter in all versions up to, and including, 1.12.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addon Elements
Affected
up to 1.12.11
What to do
Affects up to 1.12.11. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 1, 2024Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51534 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content allows Stored XSS.This issue affects Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content: from n/a through 0.6.2.
Product
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024InstaWP Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-23507 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
Product
InstaWP Connect
Affected
up to 0.1.0.9
What to do
Affects up to 0.1.0.9. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 26, 2024Delhivery Logistics Courier: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-22283 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delhivery Delhivery Logistics Courier.This issue affects Delhivery Logistics Courier: from n/a through 1.0.107.
Product
Delhivery Logistics Courier
Affected
up to 1.0.107
What to do
Affects up to 1.0.107. Update Delhivery Logistics Courier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.