Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

460new WordPress flaws this week

394,717entries in the database

16,034 results · page 254 of 321

Mar 25, 2024Themify Shortcodes: Stored Cross-Site ScriptingCVE-2024-2732 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Themify Shortcodes
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Themify Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 25, 2024Youzify - Buddypress Moderation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-2864 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify - Buddypress Moderation.This issue affects Youzify - Buddypress Moderation: from n/a through 1.2.5.
Product
Youzify - Buddypress Moderation
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Youzify - Buddypress Moderation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024easy-popup-show all versions: Cross-site request forgery (CSRF)CVE-2024-29009 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site request forgery (CSRF) vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the authentication of the administrator and to perform unintended operations if the administrator views a malicious page while logged in.
Product
easy-popup-show all versions
What to do
Update easy-popup-show all versions to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Mar 23, 2024Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing: Cross-Site Request ForgeryCVE-2024-2326 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's configuration including stripe integration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 23, 2024Page Builder Gutenberg Blocks – CoBlocks: Stored Cross-Site ScriptingCVE-2024-1049 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget's in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on the link value. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder Gutenberg Blocks – CoBlocks
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Page Builder Gutenberg Blocks – CoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 22, 2024Page Builder by SiteOrigin: Stored Cross-Site ScriptingCVE-2024-2202 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the legacy Image widget in all versions up to, and including, 2.29.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder by SiteOrigin
Affected
up to 2.29.6
What to do
Affects up to 2.29.6. Update Page Builder by SiteOrigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2024Move Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-2131 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's infobox and button widget in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-29920 may be a duplicate of this issue.
Product
Move Addons for Elementor
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Move Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 22, 2024Custom WooCommerce Checkout Fields Editor: Stored Cross-Site ScriptingCVE-2024-1697 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom WooCommerce Checkout Fields Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the save_wcfe_options function in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Custom WooCommerce Checkout Fields Editor
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Custom WooCommerce Checkout Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2024ColorMag: Stored Cross-Site ScriptingCVE-2024-2500 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ColorMag
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update ColorMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Mar 21, 2024Blocksy Companion: Stored Cross-Site ScriptingCVE-2024-2392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Blocksy Companion
Affected
up to 2.0.31
What to do
Affects up to 2.0.31. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Stored Cross-Site ScriptingCVE-2024-0957 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected invoice for printing.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2024Automation By Autonami: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-2580 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Automation By Autonami allows Stored XSS.This issue affects Automation By Autonami: from n/a through 2.8.2.
Product
Automation By Autonami
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update Automation By Autonami to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Tracking Code Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-2579 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.0.16.
Product
Tracking Code Manager
Affected
up to 2.0.16
What to do
Affects up to 2.0.16. Update Tracking Code Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024WP Coder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-2578 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.
Product
WP Coder
Affected
up to 3.5
What to do
Affects up to 3.5. Update WP Coder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Super Page Cache for Cloudflare: Cross-Site Request Forgery (CSRF)CVE-2024-27968 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.This issue affects Super Page Cache for Cloudflare: from n/a through 4.7.5.
Product
Super Page Cache for Cloudflare
Affected
up to 4.7.5
What to do
Affects up to 4.7.5. Update Super Page Cache for Cloudflare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024WPFunnels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27965 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.
Product
WPFunnels
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Crisp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27963 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/a through 0.44.
Product
Crisp
Affected
up to 0.44
What to do
Affects up to 0.44. Update Crisp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024wp-mpdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27962 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Florian 'fkrauthan' Krauthan allows Reflected XSS.This issue affects wp-mpdf: from n/a through 3.7.1.
Product
wp-mpdf
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update wp-mpdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27995 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup allows Stored XSS.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: from n/a through 4.0.23.
Product
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Affected
up to 4.0.23
What to do
Affects up to 4.0.23. Update ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024YITH WooCommerce Product Add-Ons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27994 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.5.0.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Calendarista Basic Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.
Product
Calendarista Basic Edition
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024File Manager: Cross-Site Request ForgeryCVE-2024-1538 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5.
Product
File Manager
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Tutor LMS – eLearning and online course solution: Cross-Site Request ForgeryCVE-2024-1503 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Shariff Wrapper: Stored Cross-Site ScriptingCVE-2024-1450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.10 due to insufficient input sanitization and output escaping on user supplied attributes such as 'align'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-29109 appears to be a duplicate of this issue.
Product
Shariff Wrapper
Affected
up to 4.6.10
What to do
Affects up to 4.6.10. Update Shariff Wrapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2024Jeg Elementor Kit: Stored Cross-Site ScriptingCVE-2024-1326 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-29101 is likely a duplicate of this issue.
Product
Jeg Elementor Kit
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2024Easy Social Feed – Social Photos Gallery – Post Feed – Like Box: Stored Cross-Site ScriptingCVE-2024-1278 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'efb_likebox' shortcode in all versions up to, and including, 6.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Affected
up to 6.5.4
What to do
Affects up to 6.5.4. Update Easy Social Feed – Social Photos Gallery – Post Feed – Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Easy Social Feed – Social Photos Gallery – Post Feed – Like Box: Cross-Site Request ForgeryCVE-2024-1214 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the save_groups_list function. This makes it possible for unauthenticated attackers to disconnect a site's facebook or instagram page/group connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Affected
up to 6.5.4
What to do
Affects up to 6.5.4. Update Easy Social Feed – Social Photos Gallery – Post Feed – Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Easy Social Feed – Social Photos Gallery – Post Feed – Like Box: Cross-Site Request ForgeryCVE-2024-1213 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the esf_insta_save_access_token and efbl_save_facebook_access_token functions. This makes it possible for unauthenticated attackers to connect their facebook and instagram pages to the site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Affected
up to 6.5.4
What to do
Affects up to 6.5.4. Update Easy Social Feed – Social Photos Gallery – Post Feed – Like Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Shariff Wrapper: Stored Cross-Site ScriptingCVE-2024-0966 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping on user supplied attributes like 'info_text'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks the information icon.
Product
Shariff Wrapper
Affected
up to 4.6.9
What to do
Affects up to 4.6.9. Update Shariff Wrapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2024Shariff Wrapper: Stored Cross-Site ScriptingCVE-2023-6500 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping on user supplied attributes such as 'secondarycolor' and 'maincolor'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Shariff Wrapper
Affected
up to 4.6.9
What to do
Affects up to 4.6.9. Update Shariff Wrapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024UX Flat: Stored Cross-Site ScriptingCVE-2024-2459 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The UX Flat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UX Flat
Affected
up to 4.4
What to do
Affects up to 4.4. Update UX Flat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 20, 2024Animated Headline: Stored Cross-Site ScriptingCVE-2024-2304 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Animated Headline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animated-headline' shortcode in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Animated Headline
Affected
up to 4.0
What to do
Affects up to 4.0. Update Animated Headline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 20, 2024WPBITS Addons For Elementor Page Builder: Stored Cross-Site ScriptingCVE-2024-2129 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's heading widget in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPBITS Addons For Elementor Page Builder
Affected
up to 1.4
What to do
Affects up to 1.4. Update WPBITS Addons For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 20, 2024Website Article Monetization By MageNet: Stored Cross-Site ScriptingCVE-2024-1379 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Website Article Monetization By MageNet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'abp_auth_key' parameter in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping and a missing authorization check. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Website Article Monetization By MageNet
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Website Article Monetization By MageNet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2024Live Sales Notification for Woocommerce – Woomotiv: Cross-Site Request ForgeryCVE-2024-1325 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.3. This is due to missing or incorrect nonce validation on the 'ajax_cancel_review' function. This makes it possible for unauthenticated attackers to reset the site's review count via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Live Sales Notification for Woocommerce – Woomotiv
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Live Sales Notification for Woocommerce – Woomotiv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Standout Color Boxes and Buttons: Stored Cross-Site ScriptingCVE-2024-2474 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Standout Color Boxes and Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'color-button' shortcode in all versions up to, and including, 0.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Standout Color Boxes and Buttons
Affected
up to 0.7.0
What to do
Affects up to 0.7.0. Update Standout Color Boxes and Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 20, 2024Translate WordPress and go Multilingual – Weglot: Stored Cross-Site ScriptingCVE-2024-2124 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Translate WordPress and go Multilingual – Weglot
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update Translate WordPress and go Multilingual – Weglot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2024Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2024-2255 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping on user supplied attributes such as listStyle. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2024GamiPress – Button: Stored Cross-Site ScriptingCVE-2024-2460 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GamiPress – Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gamipress_button' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GamiPress – Button
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update GamiPress – Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 19, 2024Contests by Rewards Fuel: Stored Cross-Site ScriptingCVE-2024-1787 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_rewards_fuel_api_key' parameter in all versions up to, and including, 2.0.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contests by Rewards Fuel
Affected
up to 2.0.64
What to do
Affects up to 2.0.64. Update Contests by Rewards Fuel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 19, 2024Contests by Rewards Fuel: Cross-Site Request ForgeryCVE-2024-1785 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Contests by Rewards Fuel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.62. This is due to missing or incorrect nonce validation on the ajax_handler() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site's user with the edit_posts capability into performing an action such as clicking on a link.
Product
Contests by Rewards Fuel
Affected
up to 2.0.62
What to do
Affects up to 2.0.62. Update Contests by Rewards Fuel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 19, 2024HT Easy GA4 ( Google Analytics 4 ): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29094 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) allows Stored XSS.This issue affects HT Easy GA4 ( Google Analytics 4 ): from n/a through 1.1.7.
Product
HT Easy GA4 ( Google Analytics 4 )
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update HT Easy GA4 ( Google Analytics 4 ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Builder for WooCommerce reviews shortcodes – ReviewShort: Cross-Site Request Forgery (CSRF)CVE-2024-29093 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through <= 1.01.3.
Product
Builder for WooCommerce reviews shortcodes – ReviewShort
Affected
up to 1.01.3
What to do
Affects up to 1.01.3. Update Builder for WooCommerce reviews shortcodes – ReviewShort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Permalink Manager Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29092 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.
Product
Permalink Manager Lite
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WP Armour – Honeypot Anti Spam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29091 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dnesscarkey WP Armour – Honeypot Anti Spam allows Reflected XSS.This issue affects WP Armour – Honeypot Anti Spam: from n/a through 2.1.13.
Product
WP Armour – Honeypot Anti Spam
Affected
up to 2.1.13
What to do
Affects up to 2.1.13. Update WP Armour – Honeypot Anti Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Five Star Restaurant Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29089 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Five Star Plugins Five Star Restaurant Menu allows Stored XSS.This issue affects Five Star Restaurant Menu: from n/a through 2.4.14.
Product
Five Star Restaurant Menu
Affected
up to 2.4.14
What to do
Affects up to 2.4.14. Update Five Star Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Barcode Scanner with Inventory & Order Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27998 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27997 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through <= 45.6.0.
Product
Visual Composer Website Builder
Affected
up to 45.6.0
What to do
Affects up to 45.6.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27996 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS.This issue affects Survey Maker: from n/a through 4.0.5.
Product
Survey Maker
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29108 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leevio Happy Addons for Elementor allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.10.1.
Product
Happy Addons for Elementor
Affected
up to 3.10.1
What to do
Affects up to 3.10.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.