Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,856 results · page 29 of 58

Dec 16, 2024Category of Posts: Cross-Site Request Forgery (CSRF)CVE-2024-54427 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ljmacphee Category of Posts list-one-category-of-posts allows Stored XSS.This issue affects Category of Posts: from n/a through <= 1.0.
Product
Category of Posts
Affected
up to 1.0
What to do
Affects up to 1.0. Update Category of Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Display Future Posts: Cross-Site Request Forgery (CSRF)CVE-2024-54413 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in brandt-net Display Future Posts display-future-posts allows Stored XSS.This issue affects Display Future Posts: from n/a through <= 0.2.3.
Product
Display Future Posts
Affected
up to 0.2.3
What to do
Affects up to 0.2.3. Update Display Future Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Visual Recent Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54403 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oktoberfive Visual Recent Posts visual-recent-posts allows Reflected XSS.This issue affects Visual Recent Posts: from n/a through <= 1.2.3.
Product
Visual Recent Posts
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Visual Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Posts Date Ranges: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54387 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaytesh Barange Posts Date Ranges posts-date-ranges allows Reflected XSS.This issue affects Posts Date Ranges: from n/a through <= 2.2.
Product
Posts Date Ranges
Affected
up to 2.2
What to do
Affects up to 2.2. Update Posts Date Ranges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Tithe.ly Giving Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11841 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Tithe.ly Giving Button
Affected
up to 1.1
What to do
Affects up to 1.1. Update Tithe.ly Giving Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 14, 2024Post to Pdf: Stored Cross-Site ScriptingCVE-2024-12446 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gmptp_single_post' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post to Pdf
Affected
up to 1.0
What to do
Affects up to 1.0. Update Post to Pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Shortcodes for Elementor: Information ExposureCVE-2024-10690 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the 'SHORTCODE_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created with Elementor that they should not have access to.
Product
Shortcodes for Elementor
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Shortcodes for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Tickera – WordPress Event Ticketing: Information ExposureCVE-2024-12578 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the 'tickera_tickets_info' endpoint. This makes it possible for unauthenticated attackers to extract sensitive data from bookings like full names, email addresses, check-in/out timestamps and more.
Product
Tickera – WordPress Event Ticketing
Affected
up to 3.5.4.8
What to do
Affects up to 3.5.4.8. Update Tickera – WordPress Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Posts and Products Views for WooCommerce: Stored Cross-Site ScriptingCVE-2024-12448 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'papvfwc_views' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Posts and Products Views for WooCommerce
Affected
up to 2.1
What to do
Affects up to 2.1. Update Posts and Products Views for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Get Post Content Shortcode: Insecure Direct Object ReferenceCVE-2024-12447 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-content' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the content of password-protected, private, draft, and pending posts.
Product
Get Post Content Shortcode
Affected
up to 0.4
What to do
Affects up to 0.4. Update Get Post Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Post Carousel & Slider: Stored Cross-Site ScriptingCVE-2024-11770 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Carousel & Slider
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Post Carousel & Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2024Plain Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mashiurz Plain Post plain-post allows Stored XSS.This issue affects Plain Post: from n/a through <= 1.0.3.
Product
Plain Post
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Plain Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Mark New Posts: Missing AuthorizationCVE-2024-54311 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in i.lychkov Mark New Posts mark-new-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark New Posts: from n/a through <= 7.5.1.
Product
Mark New Posts
Affected
up to 7.5.1
What to do
Affects up to 7.5.1. Update Mark New Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024PostBox: Insertion of Sensitive Information Into Sent DataCVE-2024-54309 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in wpdebuglog PostBox postbox-email-logs allows Retrieve Embedded Sensitive Data.This issue affects PostBox: from n/a through <= 1.0.4.
Product
PostBox
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update PostBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Advanced Blog Post Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54287 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through <= 1.0.4.
Product
Advanced Blog Post Block
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Advanced Blog Post Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Posts Like Dislike: Missing AuthorizationCVE-2023-41849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Happy Coders Posts Like Dislike allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Like Dislike: from n/a through 1.1.0.
Product
Posts Like Dislike
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Posts Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Post to Google My Business (Google Business Profile): Missing AuthorizationCVE-2023-41689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14.
Product
Post to Google My Business (Google Business Profile)
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update Post to Google My Business (Google Business Profile) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Duplicate Post Page Menu & Custom Post Type: Missing AuthorizationCVE-2023-36526 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Inqsys Technology Duplicate Post Page Menu & Custom Post Type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Duplicate Post Page Menu & Custom Post Type: from n/a through 2.4.1.
Product
Duplicate Post Page Menu & Custom Post Type
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Duplicate Post Page Menu & Custom Post Type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Post Hit Counter: Missing AuthorizationCVE-2023-36518 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2.
Product
Post Hit Counter
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Post Hit Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Trending/Popular Post Slider and Widget: Missing AuthorizationCVE-2022-46846 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Trending/Popular Post Slider and Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trending/Popular Post Slider and Widget: from n/a through 1.5.7.
Product
Trending/Popular Post Slider and Widget
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Trending/Popular Post Slider and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Rate My Post – Star Rating Plugin by FeedbackWP: Insecure Direct Object ReferenceCVE-2024-12309 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.4 via the get_post_status() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to vote on unpublished scheduled posts.
Product
Rate My Post – Star Rating Plugin by FeedbackWP
Affected
up to 4.2.4
What to do
Affects up to 4.2.4. Update Rate My Post – Star Rating Plugin by FeedbackWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-10678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Ultimate Blocks
Fixed in
3.2.4
What to do
Update Ultimate Blocks to 3.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2024Greenshift – animation and page builder blocks: Information ExposureCVE-2024-11181 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wp_reusable_render' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Greenshift – animation and page builder blocks
Affected
up to 9.9.9.3
What to do
Affects up to 9.9.9.3. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Accept Stripe Payments Using Contact Form 7: Information ExposureCVE-2024-12255 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf7sa-info.php file that returns phpinfo() data. This makes it possible for unauthenticated attackers to extract configuration information that can be leveraged in another attack.
Product
Accept Stripe Payments Using Contact Form 7
Affected
up to 2.5
What to do
Affects up to 2.5. Update Accept Stripe Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024ElementInvader Addons for Elementor: Sensitive Information ExposureCVE-2024-12059 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the eli_option_value shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract arbitrary options from the wp_options table.
Product
ElementInvader Addons for Elementor
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Gutenberg Blocks with AI by Kadence WP: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-10637 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Gutenberg Blocks with AI by Kadence WP
Fixed in
3.2.54
What to do
Update Gutenberg Blocks with AI by Kadence WP to 3.2.54 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2024AI Content Writer, RSS Feed to Post, Autoblogging SEO Help: Reflected Cross-Site ScriptingCVE-2024-12156 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AI Content Writer, RSS Feed to Post, Autoblogging SEO Help
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update AI Content Writer, RSS Feed to Post, Autoblogging SEO Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024AI Post Generator | AutoWriter: Unauthorized modification of dataCVE-2024-11709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ai_post_generator_delete_Post AJAX action in all versions up to, and including, 3.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary pages and posts.
Product
AI Post Generator | AutoWriter
Affected
up to 3.5
What to do
Affects up to 3.5. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024Restrict – membership, site, content and user access restrictions for: Sensitive Information ExposureCVE-2024-11351 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.8 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Restrict – membership, site, content and user access restrictions for
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Restrict – membership, site, content and user access restrictions for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024Last Viewed Posts by WPBeginner: Sensitive Information ExposureCVE-2024-12294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the 'get_legacy_cookies' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and permalinks of private, password-protected, pending, and draft posts.
Product
Last Viewed Posts by WPBeginner
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Last Viewed Posts by WPBeginner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024Members – Membership & User Role Editor: Sensitive Information ExposureCVE-2024-11008 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Members – Membership & User Role Editor
Affected
up to 3.2.10
What to do
Affects up to 3.2.10. Update Members – Membership & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 10, 2024LearnPress – WordPress LMS: Sensitive Information ExposureCVE-2024-11868 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. This makes it possible for unauthenticated attackers to extract potentially sensitive paid course material.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.7.3
What to do
Affects up to 4.2.7.3. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record abrahack.com plugins.trac.wordpress.org
Dec 10, 2024Simple Restrict: Sensitive Information ExposureCVE-2024-11106 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Simple Restrict
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Simple Restrict to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2024Analytify: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-53814 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a through <= 5.4.3.
Product
Analytify
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53818 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.15.
Product
PostX
Affected
up to 4.1.15
What to do
Affects up to 4.1.15. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Post Duplicator: Missing AuthorizationCVE-2023-49835 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through 2.31.
Product
Post Duplicator
Affected
up to 2.31
What to do
Affects up to 2.31. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Bulk Edit Post Titles: Missing AuthorizationCVE-2023-49754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Yogesh Pawar Bulk Edit Post Titles bulk-edit-post-titles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Edit Post Titles: from n/a through <= 5.0.0.
Product
Bulk Edit Post Titles
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Bulk Edit Post Titles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Void Elementor Post Grid Addon for Elementor Page builder: Missing AuthorizationCVE-2023-48750 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in voidthemes Void Elementor Post Grid Addon for Elementor Page builder void-elementor-post-grid-addon-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through <= 2.1.10.
Product
Void Elementor Post Grid Addon for Elementor Page builder
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update Void Elementor Post Grid Addon for Elementor Page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Extended Post Status: Missing AuthorizationCVE-2023-32094 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Felix Welberg Extended Post Status allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extended Post Status: from n/a through 1.0.19.
Product
Extended Post Status
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Extended Post Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024WP Quick Post Duplicator: Missing AuthorizationCVE-2023-31214 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through 2.0.
Product
WP Quick Post Duplicator
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP Quick Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Display custom fields in the frontend – Post and User Profile Fields: Missing AuthorizationCVE-2023-31073 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0.
Product
Display custom fields in the frontend – Post and User Profile Fields
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Featured Post Creative: Missing AuthorizationCVE-2023-30488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through 1.2.7.
Product
Featured Post Creative
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Featured Post Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Remove Duplicate Posts: Missing AuthorizationCVE-2023-29237 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Remove Duplicate Posts: from n/a through 1.3.5.
Product
Remove Duplicate Posts
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Remove Duplicate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024WP Repost: Missing AuthorizationCVE-2023-26522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in OneWebsite WP Repost allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Repost: from n/a through 0.1.
Product
WP Repost
Affected
up to 0.1
What to do
Affects up to 0.1. Update WP Repost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Protected Posts Logout Button: Missing AuthorizationCVE-2023-25454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protected Posts Logout Button: from n/a through 1.4.5.
Product
Protected Posts Logout Button
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Protected Posts Logout Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024WP Private Content Plus: Sensitive Information ExposureCVE-2024-11292 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
WP Private Content Plus
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update WP Private Content Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 6, 2024PowerPack Elementor Addons (Free Widgets, Extensions and Templates): Information ExposureCVE-2024-10692 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 via the Content Reveal widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update PowerPack Elementor Addons (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024XLTab – Accordions and Tabs for Elementor Page Builder: Information ExposureCVE-2024-10689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The XLTab – Accordions and Tabs for Elementor Page Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4 via the 'XLTAB_INSERT_TPL' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
XLTab – Accordions and Tabs for Elementor Page Builder
Affected
up to 1.4
What to do
Affects up to 1.4. Update XLTab – Accordions and Tabs for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2024AnyWhere Elementor: Information ExposureCVE-2024-10777 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
AnyWhere Elementor
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2024Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins: Sensitive Information ExposureCVE-2024-10937 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.58 via the wp_ajax_nopriv_related_post_ajax_get_post_ids AJAX action. This makes it possible for unauthenticated attackers to extract sensitive data including titles of posts in draft status.
Product
Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins
Affected
up to 2.0.58
What to do
Affects up to 2.0.58. Update Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.