Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
237 results · page 3 of 5
Feb 1, 2025WP Job Portal – A Complete Recruitment System for Company or Job Board website: Insecure Direct Object ReferenceCVE-2024-13425 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the enforcedelete() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Employer-level access and above, to delete other users companies.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 1, 2025WP Job Portal – A Complete Recruitment System for Company or Job Board website: Insecure Direct Object ReferenceCVE-2024-13372 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the getresumefiledownloadbyid() and getallresumefiles() functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to download users resumes without the appropriate authorization to do so.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 1, 2025WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized arbitrary emails sendingCVE-2024-13371 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitrary emails sending due to a missing capability check on the sendEmailToJobSeeker() function in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to send arbitrary emails with arbitrary content from the sites mail server.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Jan 31, 2025Issuu Panel: Cross-Site Request Forgery (CSRF)CVE-2025-23976 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in operationsissuu Issuu Panel issuu-panel allows Stored XSS.This issue affects Issuu Panel: from n/a through <= 2.1.1.
- Product
- Issuu Panel
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Issuu Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dyn Business Panel: Does not have CSRF check in some placesCVE-2024-13057 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dyn Business Panel WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Dyn Business Panel
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dyn Business Panel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13056 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Dyn Business Panel
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dyn Business Panel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13055 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Dyn Business Panel
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Toocheke Companion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23992 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toocheke Toocheke Companion toocheke-companion allows Stored XSS.This issue affects Toocheke Companion: from n/a through <= 1.166.
- Product
- Toocheke Companion
- Affected
- up to 1.166
- What to do
- Affects up to 1.166. Update Toocheke Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WP krpano: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23876 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in No-Nonsense WP krpano wp-krpano allows Stored XSS.This issue affects WP krpano: from n/a through <= 1.2.1.
- Product
- WP krpano
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update WP krpano to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WP Panoramio: Cross-Site Request Forgery (CSRF)CVE-2025-23662 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ryscript WP Panoramio wp-panoramio allows Stored XSS.This issue affects WP Panoramio: from n/a through <= 1.5.0.
- Product
- WP Panoramio
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update WP Panoramio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025wp-pano: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey wp-pano wp-pano allows Stored XSS.This issue affects wp-pano: from n/a through <= 1.17.
- Product
- wp-pano
- Affected
- up to 1.17
- What to do
- Affects up to 1.17. Update wp-pano to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Job Portal – A Complete Recruitment System for Company or Job Board website: Insecure Direct Object ReferenceCVE-2024-12131 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit resumes for other applicants when applying for jobs.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 3, 2025WP Job Portal – A Complete Recruitment System for Company or Job Board website: Insecure Direct Object ReferenceCVE-2024-12132 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create jobs for companies that are unaffiliated with the attacker.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 31, 2024Hunk Companion: Does not correctly authorize some REST API endpointsCVE-2024-11972 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
- Product
- Hunk Companion
- Fixed in
- 1.9.0
- What to do
- Update Hunk Companion to 1.9.0 or newer.
Dec 16, 2024SV100 Companion: Incorrect Privilege AssignmentCVE-2024-54229 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Companion: from n/a through <= 2.0.02.
- Product
- SV100 Companion
- Affected
- up to 2.0.02
- What to do
- Affects up to 2.0.02. Update SV100 Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized accessCVE-2024-11715 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an employer.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL InjectionCVE-2024-11714 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'ff' parameter of the getFieldsForVisibleCombobox() function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL InjectionCVE-2024-11713 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'page_id' parameter of the wpjobportal_deactivate() function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized access of dataCVE-2024-11712 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getResumeFileDownloadById() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to download other users resumes.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL InjectionCVE-2024-11711 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'resumeid' parameter in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL InjectionCVE-2024-11710 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'fieldfor', 'visibleParent' and 'id' parameters in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024Companion Portfolio – Responsive Portfolio: Stored Cross-Site ScriptingCVE-2024-11867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Companion Portfolio – Responsive Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'companion-portfolio' shortcode in all versions up to, and including, 2.4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Companion Portfolio – Responsive Portfolio
- Affected
- up to 2.4.0.1
- What to do
- Affects up to 2.4.0.1. Update Companion Portfolio – Responsive Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2024Japanized For WooCommerce: Missing AuthorizationCVE-2023-47698 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in shohei.tanaka Japanized For WooCommerce woocommerce-for-japan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Japanized For WooCommerce: from n/a through <= 2.6.4.
- Product
- Japanized For WooCommerce
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Japanized For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024SV100 Companion: Unauthorized modification of data that can lead to privilege escalationCVE-2024-12155 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SV100 Companion plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the settings_import() function in all versions up to, and including, 2.0.02. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2024-54229 may be a duplicate of this issue.
- Product
- SV100 Companion
- Affected
- up to 2.0.02
- What to do
- Affects up to 2.0.02. Update SV100 Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 4, 2024WP Job Manager – Company Profiles: Reflected Cross-Site ScriptingCVE-2023-6978 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'company' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Job Manager – Company Profiles
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update WP Job Manager – Company Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 2, 2024BBP Core – Expand bbPress powered forums with useful features: Reflected Cross-Site ScriptingCVE-2024-9896 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BBP Core – Expand bbPress powered forums with useful features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- BBP Core – Expand bbPress powered forums with useful features
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update BBP Core – Expand bbPress powered forums with useful features to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024iPanorama 360 WordPress Virtual Tour Builder: Missing AuthorizationCVE-2024-38690 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.3.
- Product
- iPanorama 360 WordPress Virtual Tour Builder
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024MAS Companies For WP Job Manager: Reflected Cross-Site ScriptingCVE-2024-9206 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- MAS Companies For WP Job Manager
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update MAS Companies For WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024Hunk Companion: Unauthorized plugin installation/activationCVE-2024-9707 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
- Product
- Hunk Companion
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Hunk Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 3, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Local File Inclusion, Arbitrary Settings Update, and User CreationCVE-2024-7950 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Attackers can also update arbitrary settings and create user accounts even when registration is disabled, leading to user creation with a default role of Administrator.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2024Participants Database: Deserialization of Untrusted DataCVE-2024-43141 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.
- Product
- Participants Database
- Affected
- up to 2.5.9.2
- What to do
- Affects up to 2.5.9.2. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2024Mediavine Control Panel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43218 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mediavine Mediavine Control Panel mediavine-control-panel.This issue affects Mediavine Control Panel: from n/a through <= 2.10.4.
- Product
- Mediavine Control Panel
- Affected
- up to 2.10.4
- What to do
- Affects up to 2.10.4. Update Mediavine Control Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2024ParcelPanel: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43163 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Parcel Panel ParcelPanel allows Reflected XSS.This issue affects ParcelPanel: from n/a through 4.3.2.
- Product
- ParcelPanel
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update ParcelPanel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 20, 2024VK All in One Expansion Unit: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37956 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vektor,Inc. VK All in One Expansion Unit allows Stored XSS.This issue affects VK All in One Expansion Unit: from n/a through 9.99.1.0.
- Product
- VK All in One Expansion Unit
- Affected
- up to 9.99.1.0
- What to do
- Affects up to 9.99.1.0. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 9, 2024Panda Video: Stored Cross-Site ScriptingCVE-2024-5457 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Panda Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Panda Video
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Panda Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2024Panda Video: Local File InclusionCVE-2024-5456 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Panda Video plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.0 via the 'selected_button' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Panda Video
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Panda Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 7, 2024One Page Express Companion: Stored Cross-Site ScriptingCVE-2024-4703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_form shortcode in all versions up to, and including, 1.6.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- One Page Express Companion
- Affected
- up to 1.6.37
- What to do
- Affects up to 1.6.37. Update One Page Express Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 6, 2024Materialis Companion: Stored Cross-Site ScriptingCVE-2024-4707 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Materialis Companion
- Affected
- up to 1.3.41
- What to do
- Affects up to 1.3.41. Update Materialis Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 3, 2024Blocksy Companion: Server-Side Request Forgery (SSRF)CVE-2024-35633 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42.
- Product
- Blocksy Companion
- Affected
- up to 2.0.42
- What to do
- Affects up to 2.0.42. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Blocksy Companion: Stored Cross-Site ScriptingCVE-2024-4487 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG uploads in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Blocksy Companion
- Affected
- up to 2.0.45
- What to do
- Affects up to 2.0.45. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 8, 2024Mesmerize Companion: Stored Cross-Site ScriptingCVE-2024-3494 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mesmerize Companion
- Affected
- up to 1.6.148
- What to do
- Affects up to 1.6.148. Update Mesmerize Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 6, 2024ParcelPanel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-34412 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Parcel Panel ParcelPanel.This issue affects ParcelPanel: from n/a through 3.8.1.
- Product
- ParcelPanel
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update ParcelPanel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2024iPanorama 360 WordPress Virtual Tour Builder: Missing AuthorizationCVE-2024-33941 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.1.
- Product
- iPanorama 360 WordPress Virtual Tour Builder
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2024CPO Companion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33916 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0.
- Product
- CPO Companion
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update CPO Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 15, 2024MihanPanel: Cross-Site Request Forgery (CSRF)CVE-2024-31389 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ertano MihanPanel.This issue affects MihanPanel: from n/a before 12.7.
- Product
- MihanPanel
- Fixed in
- 12.7
- What to do
- Update MihanPanel to 12.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 11, 2024Blocksy Companion: Cross-Site Request Forgery (CSRF)CVE-2024-31932 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy Companion.This issue affects Blocksy Companion: from n/a through 2.0.28.
- Product
- Blocksy Companion
- Affected
- up to 2.0.28
- What to do
- Affects up to 2.0.28. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024VK All in One Expansion Unit: Sensitive Information ExposureCVE-2024-2093 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.95.0.1 via social meta tags. This makes it possible for unauthenticated attackers to view limited password protected content.
- Product
- VK All in One Expansion Unit
- Affected
- up to 9.95.0.1
- What to do
- Affects up to 9.95.0.1. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Mar 26, 2024VK All in One Expansion Unit: Stored Cross-Site ScriptingCVE-2024-2170 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and including, 9.96.0.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className.' This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- VK All in One Expansion Unit
- Affected
- up to 9.96.0.1
- What to do
- Affects up to 9.96.0.1. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 21, 2024Blocksy Companion: Stored Cross-Site ScriptingCVE-2024-2392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Blocksy Companion
- Affected
- up to 2.0.31
- What to do
- Affects up to 2.0.31. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 12, 2024CWW Companion: Stored Cross-Site ScriptingCVE-2024-2130 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CWW Companion
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update CWW Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.