Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
194 results · page 3 of 4
Dec 24, 2024DirectoryPress – Business Directory And Classified Ad Listing: Stored Cross-Site ScriptingCVE-2024-10584 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.6.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. When DirectoryPress Frontend is installed, this can be exploited by unauthenticated users.
- Product
- DirectoryPress – Business Directory And Classified Ad Listing
- Affected
- up to 3.6.16
- What to do
- Affects up to 3.6.16. Update DirectoryPress – Business Directory And Classified Ad Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 23, 2024A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress.CVE-2018-25106 · WordPress plugins & themes · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebula_send_to_hubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patch is named 41230a81db0f671c570c2644bc2f80565ca83c5a. It is recommended to apply a patch to fix this issue.
- Product
- webuidesigning NebulaX
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update webuidesigning NebulaX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 4, 2024Listdom – Business Directory and Classified Ads Listings: Stored Cross-Site ScriptingCVE-2024-11854 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Listdom – Business Directory and Classified Ads Listings
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update Listdom – Business Directory and Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 2, 2024Ultimate Classified Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52487 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows Stored XSS.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2024WPAdverts – Classifieds: Reflected Cross-Site ScriptingCVE-2024-10890 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WPAdverts – Classifieds
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update WPAdverts – Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 20, 2024Ultimate Classified Listings: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52448 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Classified Listing – Classified ads & Business Directory: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11194 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site. The vulnerability is limited in that the option updated must have a value that is an array.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.1.15.1
- What to do
- Affects up to 3.1.15.1. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 16, 2024Classified Listing: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-52386 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classified-listing allows PHP Local File Inclusion.This issue affects Classified Listing: from n/a through <= 3.1.16.
- Product
- Classified Listing
- Affected
- up to 3.1.16
- What to do
- Affects up to 3.1.16. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024WPAdverts – Classifieds: Stored Cross-Site ScriptingCVE-2024-10108 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adverts_add shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPAdverts – Classifieds
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update WPAdverts – Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 13, 2024Classified Listing – Classified ads & Business Directory: Unauthorized accessCVE-2024-7888 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions like export_forms(), import_forms(), update_fb_options(), and many more in all versions up to, and including, 3.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify forms and various other settings.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2024Ultimate Classified Listings: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6529 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ultimate Classified Listings
- Fixed in
- 1.4
- What to do
- Update Ultimate Classified Listings to 1.4 or newer.
Jul 29, 2024Ultimate Classified Listings: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5883 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ultimate Classified Listings
- Fixed in
- 1.3
- What to do
- Update Ultimate Classified Listings to 1.3 or newer.
Jul 29, 2024The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PCVE-2024-5882 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PHP files on the server from the listings page
- Product
- Ultimate Classified Listings
- Fixed in
- 1.3
- What to do
- Update Ultimate Classified Listings to 1.3 or newer.
Jul 9, 2024Advanced Classifieds & Directory Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37501 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Traversal.This issue affects Advanced Classifieds & Directory Pro: from n/a through 3.1.3.
- Product
- Advanced Classifieds & Directory Pro
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 2, 2024Motors – Car Dealer, Classifieds & Listing: Unauthorized modification of dataCVE-2024-5545 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stm_edit_delete_user_car function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpublish arbitrary posts and pages.
- Product
- Motors – Car Dealer, Classifieds & Listing
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2024AWP Classifieds: Missing AuthorizationCVE-2024-31350 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AWP Classifieds Team AWP Classifieds.This issue affects AWP Classifieds: from n/a through 4.3.1.
- Product
- AWP Classifieds
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2024Classified Listing – Classified ads & Business Directory: Unauthorized loss of dataCVE-2024-3893 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachements.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.0.10.3
- What to do
- Affects up to 3.0.10.3. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 23, 2024GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: Stored Cross-Site ScriptingCVE-2024-3732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GeoDirectory – WordPress Business Directory Plugin, or Classified Directory
- Affected
- up to 2.3.48
- What to do
- Affects up to 2.3.48. Update GeoDirectory – WordPress Business Directory Plugin, or Classified Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 21, 2024A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress.CVE-2015-10132 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin.php. The manipulation of the argument Spreadplugin leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.8.6.6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-261676.
- Affected
- up to 3.8.6.1
- What to do
- Affects up to 3.8.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024AWP Classifieds: Cross-Site Request Forgery (CSRF)CVE-2024-32447 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team AWP Classifieds.This issue affects AWP Classifieds: from n/a through 4.3.1.
- Product
- AWP Classifieds
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024Advanced Classifieds & Directory Pro: Unauthorized loss of dataCVE-2024-2222 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads.
- Product
- Advanced Classifieds & Directory Pro
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2024Classified Listing – Classified ads & Business Directory: Unauthorized access & modification of dataCVE-2024-1352 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtcl_import_location() rtcl_import_category() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2024Classified Listing – Classified ads & Business Directory: Cross-Site Request ForgeryCVE-2024-1315 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing or incorrect nonce validation on the 'rtcl_update_user_account' function. This makes it possible for unauthenticated attackers to change the administrator user's password and email address via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This locks the administrator out of the site and prevents them from resetting their password, while granting the attacker access to their account.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 31, 2024A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic.CVE-2014-125110 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic. Affected by this vulnerability is the function wfu_ajax_action_callback of the file lib/wfu_ajaxactions.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.4 is able to address this issue. The identifier of the patch is c846327df030a0a97da036a2f07c769ab9284ddb. It is recommended to upgrade the affected component. The identifier VDB-258781 was assigned to this vulnerability.
- Product
- wp-file-upload
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update wp-file-upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2024A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic.CVE-2015-10131 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic. Affected by this issue is the function admin_page_load/admin_page of the file tfo-graphviz-admin.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 594c953a345f79e26003772093b0caafc14b92c2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258620.
- Product
- chrisy TFO Graphviz
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update chrisy TFO Graphviz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 15, 2024TerraClassifieds: Cross-Site Request Forgery (CSRF)CVE-2023-51474 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Pixelemu TerraClassifieds.This issue affects TerraClassifieds: from n/a through 2.0.3.
- Product
- TerraClassifieds
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update TerraClassifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2024Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Unauthorized modification of dataCVE-2024-1322 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and enable or disable monetization and change map provider.
- Product
- Directorist – WordPress Business Directory Plugin with Classified Ads Listings
- Affected
- up to 7.8.4
- What to do
- Affects up to 7.8.4. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2024A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic.CVE-2015-10128 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royal_prettyphoto_plugin_links of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3 is able to address this issue. The patch is identified as 0d3d38cfa487481b66869e4212df1cefc281ecb7. It is recommended to upgrade the affected component. VDB-249422 is the identifier assigned to this vulnerability.
- Product
- rt-prettyphoto
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update rt-prettyphoto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2023TerraClassifieds – Simple Classifieds: Unrestricted Upload of File with Dangerous TypeCVE-2023-51473 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.
- Product
- TerraClassifieds – Simple Classifieds
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update TerraClassifieds – Simple Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50845 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode - WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory.This issue affects GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: from n/a through 2.3.28.
- Product
- GeoDirectory – WordPress Business Directory Plugin, or Classified Directory
- Affected
- up to 2.3.28
- What to do
- Affects up to 2.3.28. Update GeoDirectory – WordPress Business Directory Plugin, or Classified Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 26, 2023A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic.CVE-2015-10127 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.
- Product
- PlusCaptcha
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update PlusCaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2023Adifier - Classified Ads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49752 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads WordPress Theme.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
- Product
- Adifier - Classified Ads
- Fixed in
- 3.1.4
- What to do
- Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Adifier - Classified Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49187 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
- Product
- Adifier - Classified Ads
- Fixed in
- 3.1.4
- What to do
- Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 12, 2023Motors – Car Dealer, Classifieds & Listing: Server-Side Request Forgery (SSRF)CVE-2023-46207 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifieds & Listing: from n/a through 1.4.6.
- Product
- Motors – Car Dealer, Classifieds & Listing
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-41798 · WordPress plugins & themes · reported by PatchstackMedium 5.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.
- Product
- Directorist – WordPress Business Directory Plugin with Classified Ads Listings
- Affected
- up to 7.7.1
- What to do
- Affects up to 7.7.1. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 29, 2023A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress.CVE-2007-10003 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajax_blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. Upgrading to version 0.9.7b is able to address this issue. The patch is named 7dd8acf7cd8442609840037121074425d363b694. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-243803.
- Product
- The Hackers Diet
- Affected
- up to 0.9.6b
- What to do
- Affects up to 0.9.6b. Update The Hackers Diet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2023A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress.CVE-2005-10002 · WordPress plugins & themes · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.
- Product
- almosteffortless secure-files
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update almosteffortless secure-files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2023A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress.CVE-2012-10016 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The patch is identified as e648a8706818297cf02a665ae0bae1c069dea5f1. It is recommended to upgrade the affected component. VDB-242190 is the identifier assigned to this vulnerability.
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions.CVE-2023-41801 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions.
- Fixed in
- 4.3.1
- What to do
- Update the plugin to 4.3.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 6, 2023A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress.CVE-2015-10126 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The patch is identified as 503d9ee2482d27c065f78d9546f076a406189908. It is recommended to upgrade the affected component. VDB-241318 is the identifier assigned to this vulnerability.
- Fixed in
- 1.1.0
- What to do
- Update the plugin to 1.1.0 or newer.
Oct 5, 2023A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress.CVE-2015-10125 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
- Fixed in
- 3.7.3
- What to do
- Update the plugin to 3.7.3 or newer.
Jul 18, 2023A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic.CVE-2021-4428 · WordPress plugins & themes · reported by VulDBLow 2.7
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.
- Product
- what3words Autosuggest
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update what3words Autosuggest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.CVE-2023-37387 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2023A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic.CVE-2015-10121 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic. Affected by this vulnerability is the function embed_handler of the file beelikedmicrosite.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is d23bafb5d05fb2636a2b78331f9d3fca152903dc. It is recommended to upgrade the affected component. The identifier VDB-233365 was assigned to this vulnerability.
- Product
- Beeliked Microsite
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Beeliked Microsite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress.CVE-2015-10120 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.
- Product
- WDS Multisite Aggregate
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WDS Multisite Aggregate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress.CVE-2015-10119 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affects the function action_admin_notices_activation of the file view-all-posts-pages.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is named bf914f3a59063fa4df8fd4925ae18a5d852396d7. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-233363.
- Product
- View All Posts Page
- Affected
- up to 0.9.0
- What to do
- Affects up to 0.9.0. Update View All Posts Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress.CVE-2015-10117 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 5966a5e6343e3d5610bdfa126a5cfbae95e629b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230664.
- Product
- Gravity Forms DPS PxPay
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Gravity Forms DPS PxPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress.CVE-2015-10116 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_new_favicon of the file admin/class-favicon-by-realfavicongenerator-admin.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.2.13 is able to address this issue. The identifier of the patch is 949a1ae7216216350458844f50a72f100b56d4e7. It is recommended to upgrade the affected component. The identifier VDB-230661 was assigned to this vulnerability.
- Product
- RealFaviconGenerator Favicon
- Affected
- up to 1.2.12
- What to do
- Affects up to 1.2.12. Update RealFaviconGenerator Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress.CVE-2013-10030 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue is some unknown functionality of the file wordpress-exit-box-lite.php. The manipulation leads to information disclosure. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230672.
- Product
- Exit Box Lite
- Affected
- up to 1.06
- What to do
- Affects up to 1.06. Update Exit Box Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress.CVE-2013-10029 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the function exitboxadmin of the file wordpress-exit-box-lite.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.10 is able to address this issue. The patch is named fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230671.
- Product
- Exit Box Lite
- Affected
- up to 1.06
- What to do
- Affects up to 1.06. Update Exit Box Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.