Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

1,153 results · page 21 of 24

Dec 20, 2023Zendrop – Global Dropshipping: Unrestricted Upload of File with Dangerous TypeCVE-2023-25970 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unrestricted Upload of File with Dangerous Type vulnerability in Zendrop Zendrop – Global Dropshipping.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
Product
Zendrop – Global Dropshipping
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Zendrop – Global Dropshipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Corsa: Unrestricted Upload of File with Dangerous TypeCVE-2023-23970 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5.
Product
Corsa
Affected
up to 1.5
What to do
Affects up to 1.5. Update Corsa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Symbiostock: Unrestricted Upload of File with Dangerous TypeCVE-2023-49814 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Symbiostock symbiostock.This issue affects Symbiostock: from n/a through 6.0.0.
Product
Symbiostock
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update Symbiostock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Slider Revolution: Unrestricted Upload of File with Dangerous TypeCVE-2023-47784 · WordPress plugins & themes · reported by PatchstackHigh 8.4
Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.6.15.
Product
Slider Revolution
Affected
up to 6.6.15
What to do
Affects up to 6.6.15. Update Slider Revolution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Themify Ultra: Unrestricted Upload of File with Dangerous TypeCVE-2023-46149 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023User Submitted Posts – Enable Users to Submit Posts from the Front End: Unrestricted Upload of File with Dangerous TypeCVE-2023-45603 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts – Enable Users to Submit Posts from the Front End: from n/a through 20230902.
Product
User Submitted Posts – Enable Users to Submit Posts from the Front End
Affected
up to 20230902
What to do
Affects up to 20230902. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unrestricted Upload of File with Dangerous TypeCVE-2023-40204 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager.This issue affects Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: from n/a through 2.9.2.
Product
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Export Import Menus: Unrestricted Upload of File with Dangerous TypeCVE-2023-34385 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Akshay Menariya Export Import Menus.This issue affects Export Import Menus: from n/a through 1.8.0.
Product
Export Import Menus
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Export Import Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Download Monitor: Unrestricted Upload of File with Dangerous TypeCVE-2023-34007 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.
Product
Download Monitor
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023AutomateWoo: Unrestricted Upload of File with Dangerous TypeCVE-2023-33318 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.40.
Product
AutomateWoo
Affected
up to 4.9.40
What to do
Affects up to 4.9.40. Update AutomateWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Unrestricted Upload of File with Dangerous TypeCVE-2023-31231 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.65.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.65
What to do
Affects up to 1.5.65. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Dropshipping & Affiliation with Amazon: Unrestricted Upload of File with Dangerous TypeCVE-2023-31215 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dropshipping & Affiliation with Amazon: from n/a through 2.1.2.
Product
Dropshipping & Affiliation with Amazon
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Dropshipping & Affiliation with Amazon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023WordPress Job Board and Recruitment Plugin – JobWP: Unrestricted Upload of File with Dangerous TypeCVE-2023-29384 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.
Product
WordPress Job Board and Recruitment Plugin – JobWP
Affected
up to 2.0
What to do
Affects up to 2.0. Update WordPress Job Board and Recruitment Plugin – JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Olive One Click Demo Import: Unrestricted Upload of File with Dangerous TypeCVE-2023-29102 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.
Product
Olive One Click Demo Import
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Olive One Click Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Theme Demo Import: Unrestricted Upload of File with Dangerous TypeCVE-2023-28170 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1.
Product
Theme Demo Import
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Theme Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Quttera Web Malware Scanner: Doesn't restrict access to detailed scan logsCVE-2023-6065 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code
Product
Quttera Web Malware Scanner
Fixed in
3.4.2.1
What to do
Update Quttera Web Malware Scanner to 3.4.2.1 or newer.
Full record and what to do →NVD record drive.google.com wpscan.com
Dec 11, 2023File Manager: Does not restrict the file managers root directoryCVE-2023-5907 · WordPress plugins & themes · reported by WPScanMedium 6.5
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
Product
File Manager
Fixed in
6.3
What to do
Update File Manager to 6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 7, 2023Password Reset with Code for WordPress REST API: Improper Restriction of Excessive Authentication AttemptsCVE-2023-35039 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.
Product
Password Reset with Code for WordPress REST API
Affected
up to 0.0.15
What to do
Affects up to 0.0.15. Update Password Reset with Code for WordPress REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44150 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.13.2.
Product
Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.13.2
What to do
Affects up to 4.13.2. Update Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.CVE-2023-47668 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023WP EXtra: Unauthorized access to restricted functionalityCVE-2023-5314 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to send emails with arbitrary content to arbitrary locations from the affected site's mail server.
Product
WP EXtra
Affected
up to 6.2
What to do
Affects up to 6.2. Update WP EXtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Benedict B., Maciej Gryniuk Hyphenator plugin <= 5.1.5 versions.CVE-2023-32594 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Benedict B., Maciej Gryniuk Hyphenator plugin <= 5.1.5 versions.
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 16, 2023WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of useCVE-2023-5561 · WordPress plugins & themes · reported by WPScanMedium 5.3
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lists.debian.org wpscan.com
Oct 16, 2023DoLogin Security: Does not restrict the access of a widget that shows the IPs of failed logins to low privileged usersCVE-2023-4800 · WordPress plugins & themes · reported by WPScanMedium 6.5
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
Product
DoLogin Security
Fixed in
3.7.1
What to do
Update DoLogin Security to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023FileOrganizer: Does not restrict functionality on multisite instancesCVE-2023-3664 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.
Product
FileOrganizer
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update FileOrganizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023KiviCare: Does not restrict the information returned in a response and returns all user dataCVE-2023-2623 · WordPress plugins & themes · reported by WPScanMedium 6.5
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users
Product
KiviCare
Fixed in
3.2.1
What to do
Update KiviCare to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 23, 2023Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous TypeCVE-2023-23707 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.
Product
Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 14, 2023WP Go Maps: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2022-47595 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Go Maps (formerly WP Google Maps) plugin <= 9.0.15 versions.
Product
WP Go Maps
Affected
up to 9.0.15
What to do
Affects up to 9.0.15. Update WP Go Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2023BackupBuddy: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2022-31474 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.
Product
BackupBuddy
Affected
up to 8.7.4.1
What to do
Affects up to 8.7.4.1. Update BackupBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ithemes.com patchstack.com
Jan 4, 2023WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes CVE-2023-22622 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org github.com
Dec 12, 2022User Registration: Does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-3912 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.
Product
User Registration
Fixed in
2.2.4.1
What to do
Update User Registration to 2.2.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 26, 2022Restricted Site Access: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1613 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations.
Product
Restricted Site Access
Fixed in
7.3.2
What to do
Update Restricted Site Access to 7.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.CVE-2022-40195 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 13, 2022Log WP_Mail: Saves sent email in a publicly accessible directory using predictable filenamesCVE-2022-1412 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visitor to obtain potentially sensitive information like generated passwords.
Product
Log WP_Mail
Affected
up to 0.1
What to do
Affects up to 0.1. Update Log WP_Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022Personal Dictionary: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1013 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability.
Product
Personal Dictionary
Fixed in
1.3.4
What to do
Update Personal Dictionary to 1.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022WPGraphQL: Doesn't properly restrict access to information about other users' roles on the affected siteCVE-2019-25060 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
Product
WPGraphQL
Fixed in
0.3.5
What to do
Update WPGraphQL to 0.3.5 or newer.
Full record and what to do →NVD record github.com wpscan.com
Apr 25, 2022Page Restriction WordPress (WP): Allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator uCVE-2022-1027 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator users.
Product
Page Restriction WordPress (WP)
Fixed in
1.2.7
What to do
Update Page Restriction WordPress (WP) to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Master Addons for Elementor: Does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX actionCVE-2022-0327 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting
Product
Master Addons for Elementor
Fixed in
1.8.5
What to do
Update Master Addons for Elementor to 1.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpCVE-2021-24731 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
Product
Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
Fixed in
3.7.1.6
What to do
Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.7.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Simple Download Monitor: Saves logs in a predictable locationCVE-2021-24695 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
Product
Simple Download Monitor
Fixed in
3.9.6
What to do
Update Simple Download Monitor to 3.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Has a flaw in the social login implementationCVE-2021-24647 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
Product
Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
Fixed in
3.1.7.6
What to do
Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Simple Schools Staff Directory: Does not validate uploaded logo pictures to ensure that are indeed imagesCVE-2021-24663 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE
Product
Simple Schools Staff Directory
Affected
up to 1.1
What to do
Affects up to 1.1. Update Simple Schools Staff Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021Membership & Content Restriction – Paid Member Subscriptions: Did not sanitiseCVE-2021-24728 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
Product
Membership & Content Restriction – Paid Member Subscriptions
Fixed in
2.4.2
What to do
Update Membership & Content Restriction – Paid Member Subscriptions to 2.4.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Sep 10, 2021wp-publications: Restrictive local file inclusionCVE-2021-38360 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which allows attackers to include local zip files and achieve remote code execution, in versions up to and including 0.0.
Product
wp-publications
Affected
up to 0.0
What to do
Affects up to 0.0. Update wp-publications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2021User Profile Picture: Was affected by an IDOR issueCVE-2021-24473 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).
Product
User Profile Picture
Fixed in
2.6.0
What to do
Update User Profile Picture to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 7, 2021A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extCVE-2021-34627 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions CVE-2021-34626 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scriptCVE-2021-34625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 5, 2021REST API endpoint get_users in the User Profile Picture: Returned more information than was required for its functionality to users with the upload_files capabilityCVE-2021-24170 · WordPress plugins & themes · reported by WPScanHigh 7.5
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
Product
REST API endpoint get_users in the User Profile Picture
Fixed in
2.5.0
What to do
Update REST API endpoint get_users in the User Profile Picture to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Mar 18, 2021Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, CVE-2021-24146 · WordPress plugins & themes · reported by WPScanHigh 7.5
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
Product
Modern Events Calendar Lite
Fixed in
5.16.5
What to do
Update Modern Events Calendar Lite to 5.16.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.