Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

525 results · page 3 of 11

Oct 18, 2024There is a SQL injection vulnerability in some HikCentral Professional versions.CVE-2024-47487 · Network & remote access · Hikvision · reported by hsrc@hikvision.comHigh 7.2
There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries.
Product
HikCentral Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hikvision.com
Sep 26, 2024Sight – Professional Image Gallery and Portfolio: Unauthorized access of dataCVE-2024-9025 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated.
Product
Sight – Professional Image Gallery and Portfolio
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Sight – Professional Image Gallery and Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 24, 2024HUSKY – Products Filter Professional for WooCommerce: Insecure Direct Object ReferenceCVE-2024-7491 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woof_messenger_remove_subscr AJAX action due to missing validation on the 'key' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to unsubscribe users from a product notification sign-ups, if they can successfully obtain or brute force the key value for users who signed up to receive notifications. This vulnerability requires the plugin's Products Messenger extension to be enabled.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.6.1
What to do
Affects up to 1.3.6.1. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 13, 2024The FOX – Currency Switcher Professional for WooCommerce: Arbitrary shortcode executionCVE-2024-8271 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode in the 'woocs_get_custom_price_html' function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The FOX – Currency Switcher Professional for WooCommerce
Affected
up to 1.4.2.1
What to do
Affects up to 1.4.2.1. Update The FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2024HUSKY – Products Filter Professional for WooCommerce: Time-based SQL InjectionCVE-2024-6457 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), CVE-2024-30321 · Other software · Siemens · reported by productcert@siemens.comHigh 8.2
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 23), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly handle certain requests to their web application, which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords.
Product
SIMATIC PCS 7 V9.1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Jul 4, 2024QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload in the data parameteCVE-2024-39165 · Other software · reported by MITRECritical 9.8
QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload in the data parameter in conjunction with a .php file name in the filename parameter. This occurs because an unnecessary QR/demoapp folder.is shipped with the product.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synacktiv.com synacktiv.com
May 29, 2024HUSKY – Products Filter Professional for WooCommerce: Stored Cross-Site ScriptingCVE-2024-5039 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.5.3
What to do
Affects up to 1.3.5.3. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2024In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and CloCVE-2024-25724 · Other software · rti · reported by MITREHigh 7.3
In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers to execute code with the affected service's privileges, compromise the service's integrity, leak sensitive information, or crash the service. These attacks could be done via a remote malicious RTPS message; a compromised call with malicious parameters to the RTI_RoutingService_new, rti::recording::Service, RTI_QueuingService_new, or RTI_CDS_Service_new public APIs; or a compromised local file system containing a malicious XML file.
Product
connext_dds_professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.rti.com community.rti.com
May 2, 2024FOX – Currency Switcher Professional for WooCommerce: Unauthenticated Arbitrary Shortcode ExecutionCVE-2024-3734 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FOX – Currency Switcher Professional for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 1.4.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.
Product
FOX – Currency Switcher Professional for WooCommerce
Affected
up to 1.4.1.8
What to do
Affects up to 1.4.1.8. Update FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 29, 2024An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file intoCVE-2024-27518 · Other software · superantispyware · reported by MITREHigh 7.8
An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file into the C:\Program Files\SUPERAntiSpyware folder.
Product
professional_x
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com superantispyware.com
Apr 10, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Cross-Site Request Forgery (CSRF)CVE-2024-31430 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional, realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: from n/a through 1.0.8.1; BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.1.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC04), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8), CVE-2023-50821 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC04), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Update 8), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 1), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 16), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly validate the input provided in the login dialog box. An attacker could leverage this vulnerability to cause a persistent denial of service condition.
Product
SIMATIC PCS 7 V9.1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Mar 29, 2024HUSKY – Products Filter Professional for WooCommerce: Local File InclusionCVE-2024-3061 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.5.2
What to do
Affects up to 1.3.5.2. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 15, 2024HUSKY – Products Filter for WooCommerce Professional: Stored Cross-Site ScriptingCVE-2024-1796 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in all versions up to, and including, 1.3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'swoof_slug'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.3.5.1
What to do
Affects up to 1.3.5.1. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 15, 2024HUSKY – Products Filter for WooCommerce Professional: SQL InjectionCVE-2024-1795 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in all versions up to, and including, 1.3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.3.5.2
What to do
Affects up to 1.3.5.2. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 1, 2024Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by chanCVE-2024-25064 · Network & remote access · Hikvision · reported by hsrc@hikvision.comMedium 4.3
Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by changing parameter values.
Product
HikCentral Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hikvision.com hikvision.com
Mar 1, 2024Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker CVE-2024-25063 · Network & remote access · Hikvision · reported by hsrc@hikvision.comHigh 7.5
Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker should not have access to.
Product
HikCentral Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hikvision.com hikvision.com
Feb 21, 2024TinyMCE and TinyMCE Advanced Professsional Formats and Styles: Cross-Site Request Forgery (CSRF)CVE-2024-25904 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Stockl TinyMCE and TinyMCE Advanced Professsional Formats and Styles.This issue affects TinyMCE and TinyMCE Advanced Professsional Formats and Styles: from n/a through 1.1.2.
Product
TinyMCE and TinyMCE Advanced Professsional Formats and Styles
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update TinyMCE and TinyMCE Advanced Professsional Formats and Styles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 13, 2024Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via cCVE-2023-38960 · Other software · Raidenftpd · reported by MITREHigh 7.3
Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via crafted executable running from the installation directory.
Product
Raidenftpd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rodelllemit.medium.com rodelllemit.medium.com
Feb 10, 2024Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51480 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store allows Stored XSS.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24834 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net allows Stored XSS.This issue affects BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.
Product
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Unauthorized access of functionalityCVE-2024-0797 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 1.0.6.1. This makes it possible for subscribers and higher to execute functions intended for admin use.
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Affected
up to 1.0.6.1
What to do
Affects up to 1.0.6.1. Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Cross-Site Request ForgeryCVE-2024-0796 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6.1. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Affected
up to 1.0.6.1
What to do
Affects up to 1.0.6.1. Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Unauthorized access, modification or loss of dataCVE-2024-0791 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions in all versions up to, and including, 1.0.8.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create, delete or modify taxonomy terms.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Cross-Site Request ForgeryCVE-2024-0790 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8.1. This is due to missing or incorrect nonce validation on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions. This makes it possible for unauthenticated attackers to create, modify and delete taxonomy terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Furthermore, the functions wpbe_save_options, wpbe_bulk_delete_posts_count, wpbe_bulk_delete_posts, and wpbe_save_meta are vulnerable to Cross-Site Request Forgery allowing for plugin options update, post count deletion, post deletion and modification of post metadata via forged request.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 1, 2024WPCS – WordPress Currency Switcher Professional: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51506 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency Switcher Professional allows Stored XSS.This issue affects WPCS – WordPress Currency Switcher Professional: from n/a through 1.2.0.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22159 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional allows Reflected XSS.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: from n/a through 1.0.8.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 12, 2024A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to uplCVE-2023-50072 · Other software · Openkm · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS.
Product
Openkm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 11, 2024FOX – Currency Switcher Professional for WooCommerce: Stored Cross-Site ScriptingCVE-2023-6556 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via currency options in all versions up to, and including, 1.4.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FOX – Currency Switcher Professional for WooCommerce
Affected
up to 1.4.1.5
What to do
Affects up to 1.4.1.5. Update FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 29, 2023Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Deserialization of Untrusted DataCVE-2023-51505 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023HUSKY – Products Filter for WooCommerce Professional: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-40010 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY – Products Filter for WooCommerce Professional.This issue affects HUSKY – Products Filter for WooCommerce Professional: from n/a through 1.3.4.2.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.3.4.2
What to do
Affects up to 1.3.4.2. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 17, 2023FOX – Currency Switcher Professional for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49834 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 FOX – Currency Switcher Professional for WooCommerce.This issue affects FOX – Currency Switcher Professional for WooCommerce: from n/a through 1.4.1.4.
Product
FOX – Currency Switcher Professional for WooCommerce
Affected
up to 1.4.1.4
What to do
Affects up to 1.4.1.4. Update FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 4, 2023Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke metCVE-2023-49289 · Other software · michaelschwarz · reported by GitHubMedium 6.3
Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 are affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Ajax.NET-Professional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions.CVE-2023-46152 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions.
Fixed in
1.0.7.2
What to do
Update the plugin to 1.0.7.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 25, 2023jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications.CVE-2023-46123 · Other software · jumpserver · reported by GitHubMedium 5.3
jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password attempts by altering their apparent IP address for each request. This vulnerability has been patched in version 3.8.0.
Product
jumpserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 15, 2023JumpServer is an open source bastion host and a professional operation and maintenance security audit system.CVE-2023-42442 · Other software · jumpserver · reported by GitHubHigh 8.2
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).
Product
jumpserver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 3, 2023Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems.CVE-2023-36819 · Other software · KnowageLabs · reported by GitHubMedium 6.5
Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-services/dossier/importTemplateFile_` allows authenticated users to download template hosted on the server. However, starting in the 6.x.x branch and prior to version 8.1.8, the application does not sanitize the `_templateName_ `parameter allowing an attacker to use `*../*` in it, and escaping the directory the template are normally placed and download any file from the system. This vulnerability allows a low privileged attacker to exfiltrate sensitive configuration file. This issue has been patched in Knowage version 8.1.8.
Product
Knowage-Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 28, 2023Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions <=2.0.44CVE-2023-3034 · Other software · BKG · reported by vulnerability@ncsc.chMedium 4.7
Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions <=2.0.44
Product
NTRIP Professional Caster
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record igs.bkg.bund.de igs.bkg.bund.de
Jun 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions.CVE-2023-34028 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions.
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2023WPCS – WordPress Currency Switcher Professional: Stored Cross-Site ScriptingCVE-2023-2558 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_current_currency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023WPCS – WordPress Currency Switcher Professional: Unauthorized modification of dataCVE-2023-2557 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit an arbitrary custom drop-down currency switcher.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023WPCS – WordPress Currency Switcher Professional: Unauthorized modification of dataCVE-2023-2556 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcs_sd_delete action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete an arbitrary custom drop-down currency switcher.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023WPCS – WordPress Currency Switcher Professional: Unauthorized modification of dataCVE-2023-2555 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create a custom drop-down currency switcher.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 17, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44001 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed.
Product
Backclick
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record syss.de syss.de
Nov 17, 2022BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication.CVE-2022-42982 · Other software · Bund · reported by MITREHigh 7.5
BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (tens of kBs) and can be requested with a packet of only 30 bytes. This presents a vector that can be used for UDP amplification attacks. Normally, only authenticated streaming data will be provided over UDP and not the sourcetable.
Product
BKG Professional Ntripcaster
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve.mahi.be igs.bkg.bund.de
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44006 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation or sanitization of upload filenames, an externally reachable, unauthenticated update function permits writing files outside the intended target location. Achieving remote code execution is possible, e.g., by uploading an executable file.
Product
Backclick
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record syss.de syss.de
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44005 · Other software · Backclick · reported by MITREMedium 5.3
An issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the newsletter sign-up functionality is vulnerable to the enumeration of subscribers' e-mail addresses. Furthermore, it is possible to subscribe and verify other persons' e-mail addresses to newsletters without their consent.
Product
Backclick
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record syss.de syss.de
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44004 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password.
Product
Backclick
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record syss.de syss.de
Nov 16, 2022An issue was discovered in BACKCLICK Professional 5.9.63.CVE-2022-44003 · Other software · Backclick · reported by MITRECritical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient escaping of user-supplied input, the application is vulnerable to SQL injection at various locations.
Product
Backclick
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record syss.de syss.de

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.