Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

196 results · page 3 of 4

Dec 25, 2024Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages: Cross-Site Request ForgeryCVE-2024-12636 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.6. This is due to missing or incorrect nonce validation on the 'create_popup_delete_process' function. This makes it possible for unauthenticated attackers to delete popups via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2024XML Multilanguage Sitemap Generator: Missing AuthorizationCVE-2024-55999 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Marco Giannini XML Multilanguage Sitemap Generator xml-multilanguage-sitemap-generator.This issue affects XML Multilanguage Sitemap Generator: from n/a through <= 2.0.6.
Product
XML Multilanguage Sitemap Generator
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update XML Multilanguage Sitemap Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Code Generator Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55978 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WalletStation Code Generator Pro code-generator-pro allows SQL Injection.This issue affects Code Generator Pro: from n/a through <= 1.2.
Product
Code Generator Pro
Affected
up to 1.2
What to do
Affects up to 1.2. Update Code Generator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Feedpress Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54364 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spartac Feedpress Generator feedpress-generator allows Reflected XSS.This issue affects Feedpress Generator: from n/a through <= 1.2.1.
Product
Feedpress Generator
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Feedpress Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Kundgenerator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54319 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kundgenerator Kundgenerator kundgenerator allows Reflected XSS.This issue affects Kundgenerator: from n/a through <= 1.0.6.
Product
Kundgenerator
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Kundgenerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024QR code MeCard/vCard generator: Missing AuthorizationCVE-2023-38477 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stanislav Kuznetsov QR code MeCard/vCard generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QR code MeCard/vCard generator: from n/a through 1.6.0.
Product
QR code MeCard/vCard generator
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update QR code MeCard/vCard generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024AI Post Generator | AutoWriter: Unauthorized modification of dataCVE-2024-11709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ai_post_generator_delete_Post AJAX action in all versions up to, and including, 3.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary pages and posts.
Product
AI Post Generator | AutoWriter
Affected
up to 3.5
What to do
Affects up to 3.5. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024Button Generator – easily Button Builder: Missing AuthorizationCVE-2023-49154 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wow-Company Button Generator – easily Button Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8.
Product
Button Generator – easily Button Builder
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Button Generator – easily Button Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 7, 2024Feedpress Generator – External RSS Frontend Customizer: Reflected Cross-Site ScriptingCVE-2024-11457 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Feedpress Generator – External RSS Frontend Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Feedpress Generator – External RSS Frontend Customizer
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Feedpress Generator – External RSS Frontend Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 28, 2024SEO Landing Page Generator: Reflected Cross-Site ScriptingCVE-2024-11366 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Landing Page Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.66.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SEO Landing Page Generator
Affected
up to 1.66.2
What to do
Affects up to 1.66.2. Update SEO Landing Page Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 23, 2024PDF Invoices & Packing Slips Generator for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11361 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PDF Invoices & Packing Slips Generator for WooCommerce
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update PDF Invoices & Packing Slips Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2024Advanced PDF Generator: Cross-Site Request Forgery (CSRF)CVE-2024-51641 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Juan Camilo Advanced PDF Generator advanced-pdf-generator allows Stored XSS.This issue affects Advanced PDF Generator: from n/a through <= 0.4.0.
Product
Advanced PDF Generator
Affected
up to 0.4.0
What to do
Affects up to 0.4.0. Update Advanced PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024Print PDF Generator and Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52394 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Stored XSS.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.1.6.
Product
Print PDF Generator and Publisher
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Print PDF Generator and Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 15, 2024PDF Generator Addon for Elementor Page Builder: Path TraversalCVE-2024-9935 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-24569 may be a duplicate of this issue.
Product
PDF Generator Addon for Elementor Page Builder
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update PDF Generator Addon for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 14, 2024Instant Image Generator: Unrestricted Upload of File with Dangerous TypeCVE-2024-52377 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in bdthemes Instant Image Generator ai-image allows Upload a Web Shell to a Web Server.This issue affects Instant Image Generator: from n/a through <= 1.5.2.
Product
Instant Image Generator
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Instant Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 11, 2024Multiple Page Generator Plugin – MPG: Arbitrary file deletionCVE-2024-10672 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upsert_project_source_block() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with editor-level access and above, to delete limited files on the server.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2024Multiple Page Generator Plugin – MPG: Unauthorized modification of and access to dataCVE-2024-7424 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those functions intended for admin use resulting in subscribers being able to upload csv files and view the contents of MPG projects.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2024PDF Generator Addon for Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50449 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Stored XSS.This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through <= 1.7.4.
Product
PDF Generator Addon for Elementor Page Builder
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update PDF Generator Addon for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2024Bamazoo – Button Generator: Stored Cross-Site ScriptingCVE-2024-10150 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bamazoo – Button Generator
Affected
up to 1.0
What to do
Affects up to 1.0. Update Bamazoo – Button Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 23, 2024AI Image Generator for Your Content & Featured Images – AI Postpix: Unrestricted Upload of File with Dangerous TypeCVE-2024-49671 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Dogu Pekgoz AI Image Generator for Your Content & Featured Images – AI Postpix ai-postpix allows Upload a Web Shell to a Web Server.This issue affects AI Image Generator for Your Content & Featured Images – AI Postpix: from n/a through <= 1.1.8.
Product
AI Image Generator for Your Content & Featured Images – AI Postpix
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update AI Image Generator for Your Content & Featured Images – AI Postpix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2024Echo RSS Feed Post Generator: Privilege escalationCVE-2024-9265 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plugin not properly restricting the roles that can set during registration through the echo_check_post_header_sent() function. This makes it possible for unauthenticated attackers to register as an administrator.
Product
Echo RSS Feed Post Generator
Affected
up to 5.4.6
What to do
Affects up to 5.4.6. Update Echo RSS Feed Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 1, 2024PDF Image Generator: Reflected Cross-Site ScriptingCVE-2024-9241 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PDF Image Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PDF Image Generator
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update PDF Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2024AI ChatBot with ChatGPT and Content Generator by AYS: Lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2CVE-2024-7714 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and 'ays_chatgpt_save_feedback'
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Fixed in
2.1.0
What to do
Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2024AI ChatBot with ChatGPT and Content Generator by AYS: Discloses the Open AI API KeyCVE-2024-7713 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain it
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Fixed in
2.1.0
What to do
Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2024PDF Thumbnail Generator: Reflected Cross-Site ScriptingCVE-2024-8737 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PDF Thumbnail Generator
Affected
up to 1.3
What to do
Affects up to 1.3. Update PDF Thumbnail Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Favicon Generator (CLOSED): Does not have CSRF and path validation in the output_sub_admin_page_0() functionCVE-2024-7864 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server
Product
Favicon Generator (CLOSED)
Fixed in
2.1
What to do
Update Favicon Generator (CLOSED) to 2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2024Favicon Generator (CLOSED): Does not validate files to be uploaded and does not have CSRF checksCVE-2024-7863 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server
Product
Favicon Generator (CLOSED)
Fixed in
2.1
What to do
Update Favicon Generator (CLOSED) to 2.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 23, 2024Favicon Generator: Cross-Site Request ForgeryCVE-2024-7568 · WordPress plugins & themes · reported by WordfenceCritical 9.6
The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin. CVE-2024-7864 appears to be a duplicate of this issue.
Product
Favicon Generator
Affected
up to 1.5
What to do
Affects up to 1.5. Update Favicon Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Featured Image Generator: Unauthorized image uploadCVE-2024-5677 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the fig_save_after_generate_image function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary images to a post-related gallery.
Product
Featured Image Generator
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Featured Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 20, 2024WP Child Theme Generator: Unauthorized modification of dataCVE-2024-3610 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_theme() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child theme and activate it cause the site to whitescreen.
Product
WP Child Theme Generator
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Child Theme Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2024WP Dummy Content Generator: Missing AuthorizationCVE-2023-37394 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 2.3.0.
Product
WP Dummy Content Generator
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Copymatic – AI Content Writer & Generator: Missing AuthorizationCVE-2024-35716 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.9.
Product
Copymatic – AI Content Writer & Generator
Affected
up to 1.9
What to do
Affects up to 1.9. Update Copymatic – AI Content Writer & Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024AI Post Generator | AutoWriter: Missing AuthorizationCVE-2024-32713 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AutoWriter AI Post Generator | AutoWriter.This issue affects AI Post Generator | AutoWriter: from n/a through 3.3.
Product
AI Post Generator | AutoWriter
Affected
up to 3.3
What to do
Affects up to 3.3. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Copymatic – AI Content Writer & Generator: Unrestricted Upload of File with Dangerous TypeCVE-2024-31351 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.6.
Product
Copymatic – AI Content Writer & Generator
Affected
up to 1.6
What to do
Affects up to 1.6. Update Copymatic – AI Content Writer & Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024Button Generator: Does not have CSRF check in placeCVE-2024-3471 · WordPress plugins & themes · reported by WPScanLow 3.4
The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin delete buttons via a CSRF attack
Product
Button Generator
Fixed in
3.0
What to do
Update Button Generator to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Data Tables Generator by Supsystic: Missing AuthorizationCVE-2024-32829 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.10.31.
Product
Data Tables Generator by Supsystic
Affected
up to 1.10.31
What to do
Affects up to 1.10.31. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WP Dummy Content Generator: Improper Control of Generation of Code ('Code Injection')CVE-2024-32599 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator.This issue affects WP Dummy Content Generator: from n/a through <= 3.2.1.
Product
WP Dummy Content Generator
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Data Tables Generator: Incorrect AuthorizationCVE-2023-25043 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Incorrect Authorization vulnerability in Supsystic Data Tables Generator.This issue affects Data Tables Generator: from n/a through 1.10.25.
Product
Data Tables Generator
Affected
up to 1.10.25
What to do
Affects up to 1.10.25. Update Data Tables Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024What's New Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32548 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hideki Tanaka What's New Generator allows Stored XSS.This issue affects What's New Generator: from n/a through 2.0.2.
Product
What's New Generator
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update What's New Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 12, 2024Multiple Page Generator Plugin – MPG: Cross-Site Request Forgery (CSRF)CVE-2024-31301 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024AI Post Generator | AutoWriter: Unauthorized access, modification or deletion of postsCVE-2024-1850 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with subscriber access or higher, to view all posts generated with this plugin (even in non-published status), create new posts (and publish them), publish unpublished post or perform post deletions. CVE-2024-32713 may be a duplicate of this issue.
Product
AI Post Generator | AutoWriter
Affected
up to 3.3
What to do
Affects up to 3.3. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 3, 2024Multiple Page Generator Plugin – MPG: Unrestricted Upload of File with Dangerous TypeCVE-2024-27951 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows Upload a Web Shell to a Web Server.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Pocket News Generator: Cross-Site Request ForgeryCVE-2024-2964 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This is due to missing or incorrect nonce validation on the option_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Pocket News Generator
Affected
up to 0.2.0
What to do
Affects up to 0.2.0. Update Pocket News Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2024Pocket News Generator: Stored Cross-Site ScriptingCVE-2024-2963 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Pocket News Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as "Consumer Key" and "Access Token" in all versions up to, and including, 0.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Pocket News Generator
Affected
up to 0.2.0
What to do
Affects up to 0.2.0. Update Pocket News Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2024WP Child Theme Generator: Unrestricted Upload of File with Dangerous TypeCVE-2023-47873 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a through 1.0.9.
Product
WP Child Theme Generator
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update WP Child Theme Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Multiple Page Generator Plugin – MPG: Missing AuthorizationCVE-2024-30235 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WP Dummy Content Generator: Missing AuthorizationCVE-2024-24805 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 3.1.2.
Product
WP Dummy Content Generator
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 2, 2024AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Stored Cross-Site ScriptingCVE-2024-0378 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Arbitrary file uploadsCVE-2024-0699 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2024-29100 is likely a duplicate of this issue.
Product
AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024PDF Generator For Fluent Forms – The Contact Form: Stored Cross-Site ScriptingCVE-2023-6953 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The PDF Generator For Fluent Forms – The Contact Form Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the header, PDF body and footer content parameters in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by default is admin.
Product
PDF Generator For Fluent Forms – The Contact Form
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update PDF Generator For Fluent Forms – The Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.