Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,981 results · page 23 of 60

Jun 4, 2024wp-eMember: Does not sanitize and escape the "fieldId" parameter before outputting it back in the pageCVE-2024-4749 · WordPress plugins & themes · reported by WPScanHigh 8.3
The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Product
wp-eMember
Fixed in
10.3.9
What to do
Update wp-eMember to 10.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024Gutenberg Blocks with AI by Kadence WP: Does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embedCVE-2024-4057 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenberg Blocks with AI by Kadence WP
Fixed in
3.2.37
What to do
Update Gutenberg Blocks with AI by Kadence WP to 3.2.37 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 3, 2024WP Back Button: Cross Site Scripting (XSS)CVE-2024-35643 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Cross Site Scripting (XSS) vulnerability in Xabier Miranda WP Back Button allows Stored XSS.This issue affects WP Back Button: from n/a through 1.1.3.
Product
WP Back Button
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update WP Back Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 31, 2024WP STAGING WordPress Backup: Does not prevent users with the administrator role from pinging conducting SSRF attacksCVE-2024-4469 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
Product
WP STAGING WordPress Backup
Fixed in
3.5.0
What to do
Update WP STAGING WordPress Backup to 3.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 31, 2024Visual Website Collaboration, Feedback & Project Management – Atarim: Stored Cross-Site ScriptingCVE-2024-2793 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comments in all versions up to, and including, 3.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visual Website Collaboration, Feedback & Project Management – Atarim
Affected
up to 3.30
What to do
Affects up to 3.30. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2024PowerPack Addons for Elementor (Free Widgets, Extensions and Templates): DOM-Based Stored Cross-Site ScriptingCVE-2024-5327 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘pp_animated_gradient_bg_color’ parameter in all versions up to, and including, 2.7.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
Affected
up to 2.7.19
What to do
Affects up to 2.7.19. Update PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 29, 2024WP STAGING WordPress Backup Plugin – Migration Backup Restore: Arbitrary file uploadsCVE-2024-3412 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP STAGING WordPress Backup Plugin – Migration Backup Restore
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update WP STAGING WordPress Backup Plugin – Migration Backup Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2024Visual Website Collaboration, Feedback & Project Management – Atarim: Unauthorized accessCVE-2024-2038 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.22.6. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to modify plugin settings, delete posts, modify post titles, and upload images.
Product
Visual Website Collaboration, Feedback & Project Management – Atarim
Affected
up to 3.22.6
What to do
Affects up to 3.22.6. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 23, 2024The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attackCVE-2024-4399 · WordPress plugins & themes · reported by WPScanCritical 9.1
The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2024Pet Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3917 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Pet Manager
Affected
up to 1.4
What to do
Affects up to 1.4. Update Pet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 22, 2024Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows): Stored Cross-Site ScriptingCVE-2024-3926 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes value in widgets in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Affected
up to 5.6.1
What to do
Affects up to 5.6.1. Update Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows): Form Submission Admin Email BypassCVE-2024-3927 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form.
Product
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2024Sailthru Triggermail: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-4289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Sailthru Triggermail
Affected
up to 1.1
What to do
Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 20, 2024All in One SEO: Does not validate and escape some of its Post fields before outputting them backCVE-2024-3368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
All in One SEO
Fixed in
4.6.1.1
What to do
Update All in One SEO to 4.6.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Improper Privilege ManagementCVE-2023-51546 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Privilege Management vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels allows Privilege Escalation.This issue affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: from n/a through 4.2.1.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024WPvivid Backup and Migration: Improper Privilege ManagementCVE-2023-41243 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in WPvivid Team WPvivid Backup and Migration allows Privilege Escalation.This issue affects WPvivid Backup and Migration: from n/a through 0.9.90.
Product
WPvivid Backup and Migration
Affected
up to 0.9.90
What to do
Affects up to 0.9.90. Update WPvivid Backup and Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Booking Package: Improper Privilege ManagementCVE-2023-37389 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in SAASPROJECT Booking Package Booking Package allows Privilege Escalation.This issue affects Booking Package: from n/a through 1.5.98.
Product
Booking Package
Affected
up to 1.5.98
What to do
Affects up to 1.5.98. Update Booking Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024socialdriver-framework: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-2697 · WordPress plugins & themes · reported by WPScanMedium 6.5
The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
socialdriver-framework
Fixed in
2024.0.0
What to do
Update socialdriver-framework to 2024.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2024Base64 Encoder/Decoder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Base64 Encoder/Decoder
Affected
up to 0.9.2
What to do
Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2024The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belongingCVE-2024-3749 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3548 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Fixed in
7.1.2
What to do
Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization ofCVE-2024-4860 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization of the 'notice_id' GET parameter.
Fixed in
4.23.9
What to do
Update the plugin to 4.23.9 or newer.
Full record and what to do →NVD record tenable.com tenable.com
May 14, 2024Jetpack – WP Security, Backup, Speed, & Growth: Stored Cross-Site ScriptingCVE-2024-4392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jetpack – WP Security, Backup, Speed, & Growth
Affected
up to 13.3.1
What to do
Affects up to 13.3.1. Update Jetpack – WP Security, Backup, Speed, & Growth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3241 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Ultimate Blocks
Fixed in
3.1.7
What to do
Update Ultimate Blocks to 3.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024The Orders Tracking for WooCommerce plugin for: Arbitrary shortcode executionCVE-2024-4039 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Orders Tracking for WooCommerce plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.10. This is due to the plugin allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. A partial patch was released in 1.2.10, and a complete patch was released in 1.2.11.
Product
The Orders Tracking for WooCommerce plugin for
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update The Orders Tracking for WooCommerce plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for: Arbitrary shortcode executionCVE-2024-4038 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.3.1. This is due to the plugin for WordPress allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in some placesCVE-2024-3941 · WordPress plugins & themes · reported by WPScanMedium 4.7
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
Product
reCAPTCHA Jetpack
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in placeCVE-2024-3940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
reCAPTCHA Jetpack
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Post Grid Gutenberg Blocks and WordPress Blog
Fixed in
4.0.2
What to do
Update Post Grid Gutenberg Blocks and WordPress Blog to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024WP etracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-etracker WP etracker allows Reflected XSS.This issue affects WP etracker: from n/a through 1.0.2.
Product
WP etracker
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP etracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Carousel Slider: Does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embedCVE-2024-3703 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
Product
Carousel Slider
Fixed in
2.2.10
What to do
Update Carousel Slider to 2.2.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 3, 2024Gutenverse: Does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embedCVE-2024-3692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenverse
Fixed in
1.9.1
What to do
Update Gutenverse to 1.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2024WordPress Backup & Migration: Unauthorized access of dataCVE-2024-3546 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file name is user-provided and not properly sanitized, which allows attackers to read arbitrary log files on the file system.
Product
WordPress Backup & Migration
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024PDF Invoices & Packing Slips for WooCommerce: Server-Side Request ForgeryCVE-2024-3047 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform() function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024PDF Invoices & Packing Slips for WooCommerce: Stored Cross-Site ScriptingCVE-2024-3045 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 27, 2024BackUpWordPress: Directory TraversalCVE-2024-3034 · WordPress plugins & themes · reported by WordfenceLow 2.7
The BackUpWordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.13 via the hmbkp_directory_browse parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to traverse directories outside of the context in which the plugin should allow.
Product
BackUpWordPress
Affected
up to 3.13
What to do
Affects up to 3.13. Update BackUpWordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Fixed in
7.1.0
What to do
Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024MM-email2image: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3075 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
MM-email2image
Affected
up to 0.2.5
What to do
Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2159 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Social Sharing
Fixed in
3.3.61
What to do
Update Social Sharing to 3.3.61 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Fancy Product Designer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0905 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users
Product
Fancy Product Designer
Fixed in
6.1.8
What to do
Update Fancy Product Designer to 6.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2024TrackShip for WooCommerce: Missing AuthorizationCVE-2024-32678 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in TrackShip TrackShip for WooCommerce.This issue affects TrackShip for WooCommerce: from n/a through 1.7.5.
Product
TrackShip for WooCommerce
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update TrackShip for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Jetpack: Improper Restriction of Rendered UI Layers or FramesCVE-2023-47774 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7.
Product
Jetpack
Fixed in
12.7
What to do
Update Jetpack to 12.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024The Pack Elementor addons: Cross-Site Request Forgery (CSRF)CVE-2024-32785 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Webangon The Pack Elementor addons allows Cross-Site Scripting (XSS).This issue affects The Pack Elementor addons: from n/a through 2.0.8.3.
Product
The Pack Elementor addons
Affected
up to 2.0.8.3
What to do
Affects up to 2.0.8.3. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024The Pack Elementor addons: Server-Side Request Forgery (SSRF)CVE-2024-32718 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Webangon The Pack Elementor.This issue affects The Pack Elementor addons: from n/a through 2.0.8.2.
Product
The Pack Elementor addons
Affected
up to 2.0.8.2
What to do
Affects up to 2.0.8.2. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Strong Testimonials: Does not validate and escape some of its Testimonial fields before outputting them back in a page/postCVE-2024-3261 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The attack requires a specific view to be performed
Product
Strong Testimonials
Fixed in
3.1.12
What to do
Update Strong Testimonials to 3.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2024WooCommerce Customers Manager: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-1743 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WooCommerce Customers Manager
Fixed in
29.8
What to do
Update WooCommerce Customers Manager to 29.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2024Import WP: Does not prevent users with the administrator role from pinging conducting SSRF attacksCVE-2023-7253 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
Product
Import WP
Fixed in
2.13.1
What to do
Update Import WP to 2.13.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2024Backup Migration: Insertion of Sensitive Information into Log FileCVE-2024-32686 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.
Product
Backup Migration
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.6.0.
Product
Element Pack Elementor Addons
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Backend Designer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32591 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele De Rosa Backend Designer allows Stored XSS.This issue affects Backend Designer: from n/a through 1.3.
Product
Backend Designer
Affected
up to 1.3
What to do
Affects up to 1.3. Update Backend Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.