Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

546new WordPress flaws this week

391,964entries in the database

1,591 results · page 24 of 32

Jan 11, 2024MW WP Form: Arbitrary file uploadsCVE-2023-6316 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
MW WP Form
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Piotnet Forms: Arbitrary file uploadsCVE-2023-6220 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetforms_ajax_form_builder' function in versions up to, and including, 1.0.28. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Piotnet Forms
Affected
up to 1.0.28
What to do
Affects up to 1.0.28. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Calculated Fields Form: Stored Cross-Site ScriptingCVE-2023-6446 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Calculated Fields Form
Affected
up to 1.2.40
What to do
Affects up to 1.2.40. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2024Advanced Custom Fields (ACF): Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-40696 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.
Product
Advanced Custom Fields (ACF)
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Advanced Custom Fields (ACF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Ads Invalid Click Protection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52197 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XSS.This issue affects Ads Invalid Click Protection: from n/a through 1.0.
Product
Ads Invalid Click Protection
Affected
up to 1.0
What to do
Affects up to 1.0. Update Ads Invalid Click Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 6, 2024RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Stored Cross-Site ScriptingCVE-2023-6801 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 6, 2024RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Unauthorized settings updateCVE-2023-6798 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with author-level access or above to change the plugin's settings including proxy settings, which are also exposed to authors.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 5, 2024Custom Twitter Feeds – A Tweets Widget or X Feed Widget: Cross-Site Request Forgery (CSRF)CVE-2023-52136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.
Product
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Custom Twitter Feeds – A Tweets Widget or X Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 3, 2024OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: Unauthorized modification of data and Stored Cross-Site ScriptingCVE-2023-6600 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease note there were several attempted patched, and we consider 5.7.10 to be the most sufficiently patched.
Product
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Affected
up to 5.7.9
What to do
Affects up to 5.7.9. Update OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 1, 2024Download Manager: Does not protect file download's passwordsCVE-2023-6421 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.
Product
Download Manager
Fixed in
3.2.83
What to do
Update Download Manager to 3.2.83 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 29, 2023Calculated Fields Form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51517 · WordPress plugins & themes · reported by PatchstackMedium 4.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a through 1.2.28.
Product
Calculated Fields Form
Affected
up to 1.2.28
What to do
Affects up to 1.2.28. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023TerraClassifieds – Simple Classifieds: Unrestricted Upload of File with Dangerous TypeCVE-2023-51473 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.
Product
TerraClassifieds – Simple Classifieds
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update TerraClassifieds – Simple Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Kanban Boards for: Improper Control of Generation of Code ('Code Injection')CVE-2023-40606 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
Product
Kanban Boards for
Affected
up to 2.5.21
What to do
Affects up to 2.5.21. Update Kanban Boards for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 26, 2023rtMedia for WordPress, BuddyPress and bbPress: Loads the contents of the import file in an unsafe mannerCVE-2023-5939 · WordPress plugins & themes · reported by WPScanHigh 7.2
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.
Product
rtMedia for WordPress, BuddyPress and bbPress
Fixed in
4.6.16
What to do
Update rtMedia for WordPress, BuddyPress and bbPress to 4.6.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2023Export All Posts, Products, Orders, Refunds & Users: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-2487 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Adifier - Classified Ads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49752 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads WordPress Theme.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
Product
Adifier - Classified Ads
Fixed in
3.1.4
What to do
Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Prevent Landscape Rotation: Cross-Site Request Forgery (CSRF)CVE-2023-48772 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0.
Product
Prevent Landscape Rotation
Affected
up to 2.0
What to do
Affects up to 2.0. Update Prevent Landscape Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: Cross-Site Request Forgery (CSRF)CVE-2023-46617 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5.
Product
AdFoxly – Ad Manager, AdSense Ads & Ads.Txt
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update AdFoxly – Ad Manager, AdSense Ads & Ads.Txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Gift Up Gift Cards for WordPress and WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49744 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Gift Up Gift Up Gift Cards for WordPress and WooCommerce.This issue affects Gift Up Gift Cards for WordPress and WooCommerce: from n/a through 2.21.3.
Product
Gift Up Gift Cards for WordPress and WooCommerce
Affected
up to 2.21.3
What to do
Affects up to 2.21.3. Update Gift Up Gift Cards for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Adifier - Classified Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49187 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
Product
Adifier - Classified Ads
Fixed in
3.1.4
What to do
Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Ads by datafeedr.Com: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49169 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in datafeedr.Com Ads by datafeedr.Com allows Stored XSS.This issue affects Ads by datafeedr.Com: from n/a through 1.2.0.
Product
Ads by datafeedr.Com
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Ads by datafeedr.Com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Essential Real Estate: Arbitrary file uploadsCVE-2023-6827 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajaxUploadFonts' function in versions up to, and including, 4.3.5. This makes it possible for authenticated attackers with subscriber-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2023-6140 appears to be a duplicate of this issue.
Product
Essential Real Estate
Affected
up to 4.3.5
What to do
Affects up to 4.3.5. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 15, 2023E2Pdf: Arbitrary file uploadsCVE-2023-6826 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
E2Pdf
Affected
up to 1.20.25
What to do
Affects up to 1.20.25. Update E2Pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 14, 2023Multiple Post Passwords: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49157 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andreas Münch Multiple Post Passwords allows Stored XSS.This issue affects Multiple Post Passwords: from n/a through 1.1.1.
Product
Multiple Post Passwords
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Multiple Post Passwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 4, 2023Simply Excerpts: Does not sanitize and escape some fields in the plugin settingsCVE-2023-5137 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
Simply Excerpts
Affected
up to 1.4
What to do
Affects up to 1.4. Update Simply Excerpts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 1, 2023Contact Form 7: Arbitrary file uploadsCVE-2023-6449 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insufficient blocklisting on the 'wpcf7_antiscript_file_name' function in versions up to, and including, 5.8.3. This makes it possible for authenticated attackers with editor-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed in most cases. By default, the file will be deleted from the server immediately. However, in some cases, other plugins may make it possible for the file to live on the server longer. This can make remote code execution possible when combined with another vulnerability, such as local file inclusion.
Product
Contact Form 7
Affected
up to 5.8.3
What to do
Affects up to 5.8.3. Update Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record contactform7.com github.com
Nov 30, 2023myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47853 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin: from n/a through 2.6.1.
Product
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Export All Posts, Products, Orders, Refunds & Users: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-45066 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Import Spreadsheets from Microsoft Excel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48289 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Stored XSS.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through 10.1.3.
Product
Import Spreadsheets from Microsoft Excel
Affected
up to 10.1.3
What to do
Affects up to 10.1.3. Update Import Spreadsheets from Microsoft Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023BookingPress: Arbitrary file uploadsCVE-2023-6219 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpress_process_upload' function in versions up to, and including, 1.0.76. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
BookingPress
Affected
up to 1.0.76
What to do
Affects up to 1.0.76. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.CVE-2023-47813 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions.CVE-2023-47792 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions.
Fixed in
2.1.2
What to do
Update the plugin to 2.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.CVE-2023-47791 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Drag and Drop Multiple File Upload - Contact Form 7: Arbitrary file uploadsCVE-2023-5822 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if a user authorized to edit form, which means editor privileges or above, has added a 'multiple file upload' form field with '*' acceptable file types.
Product
Drag and Drop Multiple File Upload - Contact Form 7
Affected
up to 1.3.7.3
What to do
Affects up to 1.3.7.3. Update Drag and Drop Multiple File Upload - Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.CVE-2023-28749 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 20, 2023Magic Embeds: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4799 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Magic Embeds
Fixed in
3.1.2
What to do
Update Magic Embeds to 3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 18, 2023Plainview Protect Passwords: Cross-Site Request Forgery (CSRF)CVE-2023-47664 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview Plainview Protect Passwords.This issue affects Plainview Protect Passwords: from n/a through 1.4.
Product
Plainview Protect Passwords
Affected
up to 1.4
What to do
Affects up to 1.4. Update Plainview Protect Passwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2023Paid Memberships Pro: Arbitrary file uploadsCVE-2023-6187 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.
Product
Paid Memberships Pro
Affected
up to 2.12.3
What to do
Affects up to 2.12.3. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2023Forminator: Arbitrary file uploadsCVE-2023-6133 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed.
Product
Forminator
Affected
up to 1.27.0
What to do
Affects up to 1.27.0. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2023Motors – Car Dealer, Classifieds & Listing: Server-Side Request Forgery (SSRF)CVE-2023-46207 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifieds & Listing: from n/a through 1.4.6.
Product
Motors – Car Dealer, Classifieds & Listing
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.CVE-2023-46619 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-41798 · WordPress plugins & themes · reported by PatchstackMedium 5.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.
Product
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Gift Up Gift Cards for WordPress and WooCommerce: Stored Cross-Site ScriptingCVE-2023-5703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in all versions up to, and including, 2.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gift Up Gift Cards for WordPress and WooCommerce
Affected
up to 2.20.1
What to do
Affects up to 2.20.1. Update Gift Up Gift Cards for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2023Ninja Forms Contact Form: Does not sanitize and escape its label fieldsCVE-2023-5530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
Product
Ninja Forms Contact Form
Fixed in
3.6.34
What to do
Update Ninja Forms Contact Form to 3.6.34 or newer.
Full record and what to do →NVD record ninjaforms.com wpscan.com
Nov 2, 2023Icons Font Loader: Arbitrary file uploadsCVE-2023-5860 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Icons Font Loader
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Icons Font Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 31, 2023Popup box: Does not sanitize and escape some Popup fieldsCVE-2023-4390 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
Popup box
Fixed in
3.7.2
What to do
Update Popup box to 3.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 30, 2023Ads by datafeedr.com: Remote Code ExecutionCVE-2023-5843 · WordPress plugins & themes · reported by WordfenceCritical 9
The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.
Product
Ads by datafeedr.com
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Ads by datafeedr.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Advanced Custom Fields: Extended: Stored Cross-Site ScriptingCVE-2023-5292 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Custom Fields: Extended
Affected
up to 0.8.9.3
What to do
Affects up to 0.8.9.3. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Simple:Press – WordPress Forum: Arbitrary file uploadsCVE-2020-36706 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/admin/resources/jscript/ajaxupload/sf-uploader.php file in versions up to, and including, 6.6.0. This makes it possible for attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
Simple:Press – WordPress Forum
Affected
up to 6.6.0
What to do
Affects up to 6.6.0. Update Simple:Press – WordPress Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Oct 16, 2023WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of useCVE-2023-5561 · WordPress plugins & themes · reported by WPScanMedium 5.3
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lists.debian.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.