Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

1,148 results · page 21 of 23

Dec 18, 2023Swift Performance Lite: Does not prevent users from exporting the plugin's settingsCVE-2023-6289 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
Product
Swift Performance Lite
Fixed in
2.3.6.15
What to do
Update Swift Performance Lite to 2.3.6.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5886 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5882 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not validate and sanitise the `wp_query` parameterCVE-2023-4724 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 30, 2023Premium Addons PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-37868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
Product
Premium Addons PRO
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email download link: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.
Product
Email download link
Affected
up to 3.7
What to do
Affects up to 3.7. Update Email download link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.64.
Product
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
Affected
up to 1.0.64
What to do
Affects up to 1.0.64. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Zippy: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-26533 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.1.
Product
Zippy
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Zippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Libsyn Publisher Hub: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-25057 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.3.2.
Product
Libsyn Publisher Hub
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Libsyn Publisher Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Booster for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48333 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce.This issue affects Booster for WooCommerce: from n/a through 7.1.1.
Product
Booster for WooCommerce
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Image Regenerate & Select Crop: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-46820 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Image Regenerate & Select Crop: from n/a through 7.3.0.
Product
Image Regenerate & Select Crop
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update Image Regenerate & Select Crop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Libsyn Publisher Hub: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-45834 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.4.4.
Product
Libsyn Publisher Hub
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Libsyn Publisher Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Export All Posts, Products, Orders, Refunds & Users: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-45066 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44150 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.13.2.
Product
Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.13.2
What to do
Affects up to 4.13.2. Update Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email posts to subscribers: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-41735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscribers: from n/a through 6.2.
Product
Email posts to subscribers
Affected
up to 6.2
What to do
Affects up to 6.2. Update Email posts to subscribers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Cookies and Content Security Policy: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Cookies and Content Security Policy: from n/a through 2.15.
Product
Cookies and Content Security Policy
Affected
up to 2.15
What to do
Affects up to 2.15. Update Cookies and Content Security Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023EWWW Image Optimizer: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.
Product
EWWW Image Optimizer
Affected
up to 7.2.0
What to do
Affects up to 7.2.0. Update EWWW Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Post Grid Combo – 36+ Gutenberg Blocks: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40211 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.
Product
Post Grid Combo – 36+ Gutenberg Blocks
Affected
up to 2.2.50
What to do
Affects up to 2.2.50. Update Post Grid Combo – 36+ Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Product Stock Manager & Notifier for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-37972 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in MultiVendorX Product Stock Manager & Notifier for WooCommerce.This issue affects Product Stock Manager & Notifier for WooCommerce: from n/a through 2.0.1.
Product
Product Stock Manager & Notifier for WooCommerce
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Product Stock Manager & Notifier for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Debug Log Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-6136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0.
Product
Debug Log Manager
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Debug Log Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 23, 2023Cloud Templates & Patterns collection: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47529 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.
Product
Cloud Templates & Patterns collection
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Cloud Templates & Patterns collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 23, 2023Email Marketing for WooCommerce by Omnisend: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47244 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.
Product
Email Marketing for WooCommerce by Omnisend
Affected
up to 1.13.8
What to do
Affects up to 1.13.8. Update Email Marketing for WooCommerce by Omnisend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.CVE-2023-47668 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.CVE-2023-40002 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.CVE-2023-23978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.
Fixed in
1.0.17
What to do
Update the plugin to 1.0.17 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023WP Customer Reviews: Sensitive Information ExposureCVE-2023-4686 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.
Product
WP Customer Reviews
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2023Elementor Addon Elements: Sensitive Information ExposureCVE-2023-4723 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 via the ajax_eae_post_data function. This can allow unauthenticated attackers to extract sensitive data including post/page ids and titles including those of with pending/draft/future/private status.
Product
Elementor Addon Elements
Affected
up to 1.12.7
What to do
Affects up to 1.12.7. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions.CVE-2023-31077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions.
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Simple CSV/XLS Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-42882 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.
Product
Simple CSV/XLS Exporter
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Simple CSV/XLS Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Export Users Data CSV: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-41616 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.
Product
Export Users Data CSV
Affected
up to 2.1
What to do
Affects up to 2.1. Update Export Users Data CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WP CSV Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-38702 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.
Product
WP CSV Exporter
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP CSV Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Export Users Data Distinct: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46804 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export Users Data Distinct: from n/a through 1.3.
Product
Export Users Data Distinct
Affected
up to 1.3
What to do
Affects up to 1.3. Update Export Users Data Distinct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
Product
WordPress Comments Import & Export
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46802 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
Product
Product Reviews Import Export for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Product Reviews Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Pressference Exporter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-45046 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressference Pressference Exporter allows SQL Injection.This issue affects Pressference Exporter: from n/a through 1.0.3.
Product
Pressference Exporter
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Pressference Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023Social Media Share Buttons & Social Sharing Icons: Sensitive Information ExposureCVE-2023-5070 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.
Product
Social Media Share Buttons & Social Sharing Icons
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Social Media Share Buttons & Social Sharing Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Ad Inserter: Sensitive Information ExposureCVE-2023-4668 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths.
Product
Ad Inserter
Affected
up to 2.7.30
What to do
Affects up to 2.7.30. Update Ad Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Migration, Backup, Staging - WPvivid: Sensitive Information ExposureCVE-2023-5576 · WordPress plugins & themes · reported by WordfenceHigh 8
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate the WPVivid Google Drive account via the API if they can trick a user into reauthenticating via another vulnerability or social engineering.
Product
Migration, Backup, Staging - WPvivid
Affected
up to 0.9.91
What to do
Affects up to 0.9.91. Update Migration, Backup, Staging - WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023WooCommerce Dynamic Pricing and Discounts: Unauthenticated settings exportCVE-2021-4353 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings.
Product
WooCommerce Dynamic Pricing and Discounts
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Oct 19, 2023ChatBot: Sensitive Information ExposureCVE-2023-5254 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user function. This can allow unauthenticated attackers to extract sensitive data including confirmation as to whether a user name exists on the site as well as order information for existing users.
Product
ChatBot
Affected
up to 4.8.9
What to do
Affects up to 4.8.9. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2023Ad Inserter: Sensitive Information ExposureCVE-2023-4645 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. This can allow unauthenticated attackers to extract sensitive data such as post titles and slugs (including those of protected posts along with their passwords), usernames, available roles, the plugin license key provided the remote debugging option is enabled. In the default state it is disabled.
Product
Ad Inserter
Affected
up to 2.7.30
What to do
Affects up to 2.7.30. Update Ad Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023Vrm 360 3D Model Viewer: Exposes the full path of a fileCVE-2023-5177 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode.
Product
Vrm 360 3D Model Viewer
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Vrm 360 3D Model Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 13, 2023Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through CVE-2023-39999 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38.
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lists.debian.org lists.fedoraproject.org
Sep 12, 2023Leyka: Sensitive Information ExposureCVE-2023-4917 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more keys and passwords.
Product
Leyka
Affected
up to 3.30.7
What to do
Affects up to 3.30.7. Update Leyka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2023InfiniteWP Client: Sensitive Information ExposureCVE-2023-2916 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
Product
InfiniteWP Client
Affected
up to 1.11.1
What to do
Affects up to 1.11.1. Update InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2023WP Ultimate CSV Importer: Sensitive Information ExposureCVE-2023-4139 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated attackers to list and view exported files.
Product
WP Ultimate CSV Importer
Affected
up to 7.9.8
What to do
Affects up to 7.9.8. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 26, 2023Video Conferencing with Zoom: Sensitive Information ExposureCVE-2023-3947 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password.
Product
Video Conferencing with Zoom
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2023Export and Import Users and Customers: Unauthorized modification of dataCVE-2023-3459 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.
Product
Export and Import Users and Customers
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2023Export All URLs: Does not sanitise and escape a parameter before outputting them back in the pageCVE-2023-3118 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Export All URLs
Fixed in
4.6
What to do
Update Export All URLs to 4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 1, 2023Import / Export Customizer Settings: Cross-Site Request ForgeryCVE-2020-36737 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the astra_admin_errors() function. This makes it possible for unauthenticated attackers to display an import status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Import / Export Customizer Settings
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Import / Export Customizer Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.