Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

1,593 results · page 21 of 32

Aug 31, 2024WP Events Manager: Time-based SQL InjectionCVE-2024-7717 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Events Manager
Affected
up to 2.1.11
What to do
Affects up to 2.1.11. Update WP Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024MagePeople Team Taxi Booking Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43986 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagePeople Team Taxi Booking Manager for WooCommerce allows Stored XSS.This issue affects Taxi Booking Manager for WooCommerce: through 1.0.9.
Product
MagePeople Team Taxi Booking Manager for WooCommerce
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update MagePeople Team Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2024Permalink Manager Lite: Unauthorized access of dataCVE-2024-8195 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_query', and 'debug_redirect' functions in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to extract sensitive data including password, title, and content of password-protected posts.
Product
Permalink Manager Lite
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2024Zephyr Project Manager: Authorization Bypass Through User-Controlled KeyCVE-2024-43916 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.
Product
Zephyr Project Manager
Affected
up to 3.3.102
What to do
Affects up to 3.3.102. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Zephyr Project Manager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43915 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through .3.102.
Product
Zephyr Project Manager
Fixed in
3.3.103
What to do
Update Zephyr Project Manager to 3.3.103 or newer.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024WP User Manager: Cross-Site Request Forgery (CSRF)CVE-2024-43336 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.This issue affects WP User Manager: from n/a through <= 2.9.10.
Product
WP User Manager
Affected
up to 2.9.10
What to do
Affects up to 2.9.10. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2024WooCommerce Google Feed Manager: Unauthorized loss of dataCVE-2024-7258 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WooCommerce Google Feed Manager
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update WooCommerce Google Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2024File Manager Pro: Arbitrary file uploadsCVE-2024-7559 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions up to, and including, 8.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
File Manager Pro
Affected
up to 8.3.7
What to do
Affects up to 8.3.7. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Aug 20, 2024AdRotate Banner Manager – The only ad manager you'll need: Arbitrary file uploadsCVE-2022-1206 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AdRotate Banner Manager – The only ad manager you'll need plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension sanitization in the adrotate_insert_media() function in all versions up to, and including, 5.13.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.
Product
AdRotate Banner Manager – The only ad manager you'll need
Affected
up to 5.13.2
What to do
Affects up to 5.13.2. Update AdRotate Banner Manager – The only ad manager you'll need to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2024Login As Users: Improper Privilege ManagementCVE-2024-43311 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Geek Code Lab Login As Users allows Privilege Escalation.This issue affects Login As Users: from n/a through 1.4.2.
Product
Login As Users
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Login As Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024JobSearch: Improper Privilege ManagementCVE-2024-43245 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4.
Product
JobSearch
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Zephyr Project Manager: Authorization Bypass Through User-Controlled KeyCVE-2024-43322 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.
Product
Zephyr Project Manager
Affected
up to 3.3.100
What to do
Affects up to 3.3.100. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 17, 2024Admission AppManager: Reflected Cross-Site ScriptingCVE-2023-4507 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Admission AppManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Admission AppManager
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Admission AppManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 15, 2024Custom Field For WP Job Manager: Insecure Direct Object ReferenceCVE-2023-7049 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field For WP Job Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2 via the the 'cm_fieldshow' shortcode due to missing validation on the 'job_id' user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.
Product
Custom Field For WP Job Manager
Affected
up to 1.2
What to do
Affects up to 1.2. Update Custom Field For WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 14, 2024Zephyr Project Manager: Limited privilege escalationCVE-2024-7624 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings.
Product
Zephyr Project Manager
Affected
up to 3.3.101
What to do
Affects up to 3.3.101. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2024Event Manager for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43138 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1.
Product
Event Manager for WooCommerce
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Event Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024HUSKY: Improper Privilege ManagementCVE-2024-43121 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.
Product
HUSKY
Affected
up to 1.3.6.1
What to do
Affects up to 1.3.6.1. Update HUSKY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024Visual Website Collaboration, Feedback & Project Management – Atarim: Unauthorized modification of dataCVE-2024-7621 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the process_wpfeedback_misc_options() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings which can also be leveraged to gain access to the plugin's settings.
Product
Visual Website Collaboration, Feedback & Project Management – Atarim
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 7, 2024House Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3973 · WordPress plugins & themes · reported by WPScanMedium 4.8
The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
House Manager
Affected
up to 1.0.8.4
What to do
Affects up to 1.0.8.4. Update House Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 6, 2024Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Stored Cross-Site ScriptingCVE-2024-7317 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2024Traffic Manager: Stored Cross-Site ScriptingCVE-2024-7485 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX function in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Traffic Manager
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Traffic Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2024Zephyr Project Manager: Stored Cross-Site ScriptingCVE-2024-7356 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up to, and including, 3.3.100 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Zephyr Project Manager
Affected
up to 3.3.100
What to do
Affects up to 3.3.100. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 3, 2024File Manager Pro – Filester: Unauthorized modification of dataCVE-2024-7031 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded.
Product
File Manager Pro – Filester
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2024Zephyr Project Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38761 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.
Product
Zephyr Project Manager
Affected
up to 3.3.99
What to do
Affects up to 3.3.99. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024PowerPack Pro for Elementor: Improper Privilege ManagementCVE-2024-39634 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in IdeaBox PowerPack Pro for Elementor allows Privilege Escalation.This issue affects PowerPack Pro for Elementor: from n/a through 2.10.14.
Product
PowerPack Pro for Elementor
Affected
up to 2.10.14
What to do
Affects up to 2.10.14. Update PowerPack Pro for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024PowerPack for Beaver Builder: Improper Privilege ManagementCVE-2024-39633 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in IdeaBox PowerPack for Beaver Builder allows Privilege Escalation.This issue affects PowerPack for Beaver Builder: from n/a through 2.33.0.
Product
PowerPack for Beaver Builder
Affected
up to 2.33.0
What to do
Affects up to 2.33.0. Update PowerPack for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024CTX Feed: Improper Privilege ManagementCVE-2024-38775 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Privilege Management vulnerability in WebAppick CTX Feed allows Privilege Escalation.This issue affects CTX Feed: from n/a through 6.5.6.
Product
CTX Feed
Affected
up to 6.5.6
What to do
Affects up to 6.5.6. Update CTX Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Backup and Staging by WP Time Capsule: Improper Privilege ManagementCVE-2024-38770 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.20.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.20
What to do
Affects up to 1.22.20. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024WPForms User Registration: Improper Privilege ManagementCVE-2023-52209 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Privilege Management vulnerability in WPForms, LLC. WPForms User Registration allows Privilege Escalation.This issue affects WPForms User Registration: from n/a through 2.1.0.
Product
WPForms User Registration
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WPForms User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some bulk actionsCVE-2024-3983 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
Product
WooCommerce Customers Manager
Fixed in
30.1
What to do
Update WooCommerce Customers Manager to 30.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some placesCVE-2024-2843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks
Product
WooCommerce Customers Manager
Fixed in
30.1
What to do
Update WooCommerce Customers Manager to 30.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in various AJAX actionsCVE-2024-1747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
Product
WooCommerce Customers Manager
Fixed in
30.2
What to do
Update WooCommerce Customers Manager to 30.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2024Download Manager: Stored Cross-Site ScriptingCVE-2024-6208 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, and including, 3.2.97 due to insufficient input sanitization and output escaping on the 'cols' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Manager
Affected
up to 3.2.97
What to do
Affects up to 3.2.97. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 30, 2024Zephyr Project Manager: Does not sanitise and escape some of its settingsCVE-2024-6536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Zephyr Project Manager
Fixed in
3.3.99
What to do
Update Zephyr Project Manager to 3.3.99 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024CZ Loan Management: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5975 · WordPress plugins & themes · reported by WPScanCritical 9.1
The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
CZ Loan Management
Affected
up to 1.1
What to do
Affects up to 1.1. Update CZ Loan Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 26, 2024Media.net Ads Manager: Arbitrary file uploadsCVE-2024-6431 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the 'sendMail' function in all versions up to, and including, 2.10.13. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is only exploitable if anyone has ever logged in through the API.
Product
Media.net Ads Manager
Affected
up to 2.10.13
What to do
Affects up to 2.10.13. Update Media.net Ads Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 22, 2024Barcode Scanner with Inventory & Order Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38708 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.1.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Permalink Manager Lite: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37257 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.3.
Product
Permalink Manager Lite
Affected
up to 2.4.3.3
What to do
Affects up to 2.4.3.3. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024PZ Frontend Manager: Does not have CSRF checks in some placesCVE-2024-6244 · WordPress plugins & themes · reported by WPScanHigh 8.8
The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Product
PZ Frontend Manager
Fixed in
1.0.6
What to do
Update PZ Frontend Manager to 1.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 21, 2024PixelYourSite – Your smart PIXEL (TAG) Manager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37447 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 9.6.1.1.
Product
PixelYourSite – Your smart PIXEL (TAG) Manager
Affected
up to 9.6.1.1
What to do
Affects up to 9.6.1.1. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024BSK PDF Manager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38767 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky.Com BSK PDF Manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.6.
Product
BSK PDF Manager
Affected
up to 3.6
What to do
Affects up to 3.6. Update BSK PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024Job Board Manager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38722 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Stored XSS.This issue affects Job Board Manager: from n/a through 2.1.57.
Product
Job Board Manager
Affected
up to 2.1.57
What to do
Affects up to 2.1.57. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 17, 2024Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized data importationCVE-2024-6033 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to import events, speakers, schedules and attendee data.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2024WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Stored Cross-Site ScriptingCVE-2024-2691 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Affected
up to 3.1.43
What to do
Affects up to 3.1.43. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2024WordPress Team Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38704 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DynamicWebLab WordPress Team Manager allows PHP Local File Inclusion.This issue affects WordPress Team Manager: from n/a through 2.1.12.
Product
WordPress Team Manager
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update WordPress Team Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024WP User Switch: Improper Privilege ManagementCVE-2024-37560 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Privilege Management vulnerability in IqbalRony WP User Switch allows Privilege Escalation.This issue affects WP User Switch: from n/a through 1.1.0.
Product
WP User Switch
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WP User Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 11, 2024VikRentCar Car Rental Management System: Does not have CSRF checks in some placesCVE-2024-1845 · WordPress plugins & themes · reported by WPScanHigh 8.8
The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Product
VikRentCar Car Rental Management System
Fixed in
1.3.2
What to do
Update VikRentCar Car Rental Management System to 1.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 9, 2024Advanced File Manager Shortcodes: Directory TraversalCVE-2023-7062 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Advanced File Manager Shortcodes
Affected
up to 2.4
What to do
Affects up to 2.4. Update Advanced File Manager Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advancedfilemanager.com wordfence.com
Jul 9, 2024Advanced File Manager Shortcodes: Arbitrary file uploadsCVE-2023-7061 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Advanced File Manager Shortcodes
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Advanced File Manager Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advancedfilemanager.com wordfence.com
Jul 9, 2024BookYourTravel: Improper Privilege ManagementCVE-2024-37952 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18.17.
Product
BookYourTravel
Affected
up to 8.18.17
What to do
Affects up to 8.18.17. Update BookYourTravel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.