Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,671 results · page 26 of 54

Jan 18, 2025Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Stored Cross-Site ScriptingCVE-2024-13517 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2025MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet: Stored Cross-Site ScriptingCVE-2024-13391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet
Affected
up to 2.9.29
What to do
Affects up to 2.9.29. Update MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2025Payment Button for PayPal: Stored Cross-Site ScriptingCVE-2024-13401 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Payment Button for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_paypal_checkout' shortcode in all versions up to, and including, 1.2.3.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Payment Button for PayPal
Affected
up to 1.2.3.35
What to do
Affects up to 1.2.3.35. Update Payment Button for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 17, 2025Checkout for PayPal: Stored Cross-Site ScriptingCVE-2024-13398 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'checkout_for_paypal' shortcode in all versions up to, and including, 1.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Checkout for PayPal
Affected
up to 1.0.32
What to do
Affects up to 1.0.32. Update Checkout for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2025PayPal Marketing Solutions: Missing AuthorizationCVE-2025-23930 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paypalmuse PayPal Marketing Solutions paypal-promotions-and-insights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Marketing Solutions: from n/a through <= 1.2.
Product
PayPal Marketing Solutions
Affected
up to 1.2
What to do
Affects up to 1.2. Update PayPal Marketing Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025PayForm: Cross-Site Request Forgery (CSRF)CVE-2025-23872 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in payform PayForm payform allows Stored XSS.This issue affects PayForm: from n/a through <= 2.0.
Product
PayForm
Affected
up to 2.0
What to do
Affects up to 2.0. Update PayForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025WP Service Payment Form With Authorize.net: Cross-Site Request Forgery (CSRF)CVE-2025-23804 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shiv Prakash Tiwari WP Service Payment Form With Authorize.net wp-service-payment-form-with-authorizenet allows Reflected XSS.This issue affects WP Service Payment Form With Authorize.net: from n/a through <= 2.6.0.
Product
WP Service Payment Form With Authorize.net
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update WP Service Payment Form With Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestureCVE-2025-0442 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Jan 14, 2025Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Authentication BypassCVE-2024-12919 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pms_pb_payment_redirect_link function using the user-controlled value supplied via the 'pms_payment_id' parameter to authenticate users without any further identity validation. This makes it possible for unauthenticated attackers with knowledge of a valid payment ID to log in as any user who has made a purchase on the targeted site.
Product
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.13.7
What to do
Affects up to 2.13.7. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username fieCVE-2024-55224 · Other software · Dani-garcia · reported by MITRECritical 9.6
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
Product
Vaultwarden
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 9, 2025Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate privileges via a crafted payload to the paCVE-2024-48806 · Other software · reported by MITREMedium 6.8
Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate privileges via a crafted payload to the password field
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.neat.no
Jan 9, 2025A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intoCVE-2024-42898 · Other software · Nagios · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page.
Product
Nagios XI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com nagios.com
Jan 7, 2025Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder: Stored Cross-Site ScriptingCVE-2024-12112 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'add_form_Emsfb' AJAX action in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping and missing authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update Easy Form Builder – WordPress plugin form builder: contact form, survey form, payment form, and custom form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Donation Block For PayPal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22525 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bharat Kambariya Donation Block For PayPal donations-block allows Stored XSS.This issue affects Donation Block For PayPal: from n/a through <= 2.2.0.
Product
Donation Block For PayPal
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Donation Block For PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025PayU CommercePro: Privilege escalationCVE-2024-12264 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost REST API endpoints not properly verifying a user's identity prior to setting the users ID and auth cookies. This makes it possible for unauthenticated attackers to create new administrative user accounts.
Product
PayU CommercePro
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update PayU CommercePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025PayGreen Payment Gateway: Reflected Cross-Site ScriptingCVE-2024-11810 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PayGreen Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message_id' parameter in all versions up to, and including, 1.0.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PayGreen Payment Gateway
Affected
up to 1.0.26
What to do
Affects up to 1.0.26. Update PayGreen Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 6, 2025A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.CVE-2024-35498 · Other software · Getgrav · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Product
Grav
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com r4vanan.medium.com
Jan 2, 2025WP eCommerce Quickpay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56023 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PerfectSolution WP eCommerce Quickpay wp-ecommerce-quickpay allows Reflected XSS.This issue affects WP eCommerce Quickpay: from n/a through <= 1.1.0.
Product
WP eCommerce Quickpay
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WP eCommerce Quickpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Leaky Paywall: Cross-Site Request Forgery (CSRF)CVE-2024-37540 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Cross Site Request Forgery.This issue affects Leaky Paywall: from n/a through <= 4.21.2.
Product
Leaky Paywall
Affected
up to 4.21.2
What to do
Affects up to 4.21.2. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Paytium: Missing AuthorizationCVE-2024-51667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paytiumsupport Paytium paytium.This issue affects Paytium: from n/a through <= 4.4.10.
Product
Paytium
Affected
up to 4.4.10
What to do
Affects up to 4.4.10. Update Paytium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Unauthorized access of dataCVE-2024-12190 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bitform-form-entry-edit endpoint in all versions up to, and including, 2.17.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all form submissions from other users.
Product
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
What to do
Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Directory TraversalCVE-2024-12875 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024GTPayment Donations: Does not have CSRF check in some placesCVE-2024-11607 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
GTPayment Donations
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update GTPayment Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 18, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Sensitive Information ExposureCVE-2024-11291 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
Product
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.13.4
What to do
Affects up to 2.13.4. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2024In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS CVE-2024-56175 · Websites & servers · Optimizely · reported by MITREMedium 6.1
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names.
Product
Configured Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.optimizely.com
Dec 18, 2024In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS CVE-2024-56174 · Websites & servers · Optimizely · reported by MITREHigh 8.1
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history.
Product
Configured Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.optimizely.com
Dec 18, 2024In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS CVE-2024-56173 · Websites & servers · Optimizely · reported by MITREMedium 4.7
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from JavaScript in an SVG document.
Product
Configured Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.optimizely.com
Dec 17, 2024Accept Authorize.NET Payments Using Contact Form 7: Information ExposureCVE-2024-12250 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configuration data which can be used to aid in other attacks.
Product
Accept Authorize.NET Payments Using Contact Form 7
Affected
up to 2.2
What to do
Affects up to 2.2. Update Accept Authorize.NET Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Sensitive Information ExposureCVE-2024-8326 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 241114 via the 'sc_get_details' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including user data and database configuration information, which can lead to reading, updating, or dropping database tables. The vulnerability was partially patched in version 241114.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 241114
What to do
Affects up to 241114. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2024A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in somCVE-2024-37776 · Other software · Sunbirddcim · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in some admin screens.
Product
Dctrack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record s3.us-east-1.amazonaws.com
Dec 16, 2024Dreamfox Media Payment gateway per Product for Woocommerce: Missing AuthorizationCVE-2024-55996 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dreamfox Media Payment gateway per Product for Woocommerce: from n/a through <= 3.5.6.
Product
Dreamfox Media Payment gateway per Product for Woocommerce
Affected
up to 3.5.6
What to do
Affects up to 3.5.6. Update Dreamfox Media Payment gateway per Product for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024WP Simple Pay Lite Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55989 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kyle M Brown WP Simple Pay Lite Manager stripe-manager allows SQL Injection.This issue affects WP Simple Pay Lite Manager: from n/a through <= 1.4.
Product
WP Simple Pay Lite Manager
Affected
up to 1.4
What to do
Affects up to 1.4. Update WP Simple Pay Lite Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Invoice Payment for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54328 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linknacional Invoice Payment for WooCommerce invoice-payment-for-woocommerce allows Reflected XSS.This issue affects Invoice Payment for WooCommerce: from n/a through <= 1.7.2.
Product
Invoice Payment for WooCommerce
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Invoice Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Simple Payment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54303 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through <= 2.3.8.
Product
Simple Payment
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024BitPay Checkout for WooCommerce: Missing AuthorizationCVE-2023-41803 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BitPay BitPay Checkout for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BitPay Checkout for WooCommerce: from n/a through 4.1.0.
Product
BitPay Checkout for WooCommerce
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update BitPay Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs.CVE-2024-11986 · Other software · CrushFTP, LLC · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.6
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
Product
CrushFTP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record crushftp.com
Dec 12, 2024Web3 Crypto Payments by DePay for WooCommerce: Unauthorized access of dataCVE-2024-12265 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/depay/wc/debug REST API endpoint in all versions up to, and including, 2.12.17. This makes it possible for unauthenticated attackers to retrieve debug infromation.
Product
Web3 Crypto Payments by DePay for WooCommerce
Affected
up to 2.12.17
What to do
Affects up to 2.12.17. Update Web3 Crypto Payments by DePay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Accept Stripe Payments Using Contact Form 7: Information ExposureCVE-2024-12255 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf7sa-info.php file that returns phpinfo() data. This makes it possible for unauthenticated attackers to extract configuration information that can be leveraged in another attack.
Product
Accept Stripe Payments Using Contact Form 7
Affected
up to 2.5
What to do
Affects up to 2.5. Update Accept Stripe Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024WP Service Payment Form With Authorize.net: Reflected Cross-Site ScriptingCVE-2024-12258 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Service Payment Form With Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Service Payment Form With Authorize.net
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update WP Service Payment Form With Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2024Stripe Payments: Missing AuthorizationCVE-2023-48286 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in mra13 Stripe Payments stripe-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stripe Payments: from n/a through <= 2.0.79.
Product
Stripe Payments
Affected
up to 2.0.79
What to do
Affects up to 2.0.79. Update Stripe Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024PayTR Taksit Tablosu: Missing AuthorizationCVE-2023-47847 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayTR Taksit Tablosu: from n/a through 1.3.1.
Product
PayTR Taksit Tablosu
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update PayTR Taksit Tablosu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Quick Paypal Payments: Missing AuthorizationCVE-2023-25714 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25.
Product
Quick Paypal Payments
Affected
up to 5.7.25
What to do
Affects up to 5.7.25. Update Quick Paypal Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024PayPal Brasil para WooCommerce: Missing AuthorizationCVE-2023-25026 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2.
Product
PayPal Brasil para WooCommerce
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update PayPal Brasil para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 7, 2024Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal: Unauthorized accessCVE-2024-12253 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the plugins settings and retrieve order and log data (which is also accessible to unauthenticated users).
Product
Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 7, 2024Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal: Reflected Cross-Site ScriptingCVE-2024-12128 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘monthly_sales_current_year’ parameter in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 6, 2024CardGate Payments for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-12257 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CardGate Payments for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CardGate Payments for WooCommerce
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update CardGate Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Comfino Payment Gateway: Reflected Cross-Site ScriptingCVE-2024-11329 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Comfino Payment Gateway
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Comfino Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2024A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intoCVE-2024-50677 · Websites & servers · oroinc · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.
Product
orocommerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 3, 2024An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users.CVE-2024-46624 · Other software · infodom · reported by MITREHigh 8.8
An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users.
Product
performa_365
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Dec 2, 2024ArCa Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Planet Studio ArCa Payment Gateway arca-payment-gateway allows Stored XSS.This issue affects ArCa Payment Gateway: from n/a through <= 1.3.1.
Product
ArCa Payment Gateway
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update ArCa Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.