Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
173 results · page 3 of 4
May 6, 2024Digital Publications by Supsystic: Missing AuthorizationCVE-2024-33910 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7.
- Product
- Digital Publications by Supsystic
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update Digital Publications by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 15, 2024Digital Publications by Supsystic: Cross-Site Request Forgery (CSRF)CVE-2024-32089 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7.
- Product
- Digital Publications by Supsystic
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update Digital Publications by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 12, 2024Easy Digital Downloads: Cross-Site Request Forgery (CSRF)CVE-2024-31293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.6.
- Product
- Easy Digital Downloads
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy): Sensitive Information ExposureCVE-2024-2302 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII.
- Product
- Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy)
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 27, 2024Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more allows Stored XSS.This issue affects Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more: from n/a through 4.5.24.
- Product
- Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more
- Affected
- up to 4.5.24
- What to do
- Affects up to 4.5.24. Update Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 26, 2024WP Githuber MD: Unrestricted Upload of File with Dangerous TypeCVE-2023-47846 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Terry Lin WP Githuber MD.This issue affects WP Githuber MD: from n/a through 1.16.2.
- Product
- WP Githuber MD
- Affected
- up to 1.16.2
- What to do
- Affects up to 1.16.2. Update WP Githuber MD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 16, 2024Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates: Sensitive Information ExposureCVE-2024-1857 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the wps_wgm_preview_email_template(). This makes it possible for unauthenticated attackers to read password protected and draft posts that may contain sensitive data.
- Product
- Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates
- Affected
- up to 2.6.6
- What to do
- Affects up to 2.6.6. Update Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 7, 2024Digits: Cross-Site Request ForgeryCVE-2024-0203 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing nonce validation in the 'digits_save_settings' function. This makes it possible for unauthenticated attackers to modify the default role of registered users to elevate user privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Digits
- Affected
- up to 8.4.1
- What to do
- Affects up to 8.4.1. Update Digits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddigits.unitedover.comwordfence.com
Feb 5, 2024Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): Stored Cross-Site ScriptingCVE-2024-0659 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the variable pricing option title in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manger-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy)
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 1, 2024Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51684 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy): from n/a through 3.2.5.
- Product
- Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy)
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 16, 2024IURNY by INDIGITALL: Does not sanitise and escape some of its settingsCVE-2023-3647 · WordPress plugins & themes · reported by WPScanMedium 4.8
The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- IURNY by INDIGITALL
- Fixed in
- 3.2.3
- What to do
- Update IURNY by INDIGITALL to 3.2.3 or newer.
Dec 9, 2023Digital Publications by Supsystic: Cross-Site Request ForgeryCVE-2023-5756 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Digital Publications by Supsystic
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update Digital Publications by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin <= 1.3.3 versions.CVE-2023-28167 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin <= 1.3.3 versions.
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023Muller Digital Inc: Cross-Site Request Forgery (CSRF)CVE-2023-46204 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Muller Digital Inc. Duplicate Theme plugin <= 0.1.6 versions.
- Product
- Muller Digital Inc
- Affected
- up to 0.1.6
- What to do
- Affects up to 0.1.6. Update Muller Digital Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 12, 2023Premium Packages - Sell Digital Products Securely: Privilege escalationCVE-2023-4293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
- Product
- Premium Packages - Sell Digital Products Securely
- Affected
- up to 5.7.4
- What to do
- Affects up to 5.7.4. Update Premium Packages - Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2023Easy Digital Downloads: Improper AuthenticationCVE-2023-30869 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.
- Product
- Easy Digital Downloads
- Affected
- up to 3.1.1.4.1
- What to do
- Affects up to 3.1.1.4.1. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 21, 2023Easy Digital Downloads: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0380 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Digital Downloads
- Fixed in
- 3.1.0.5
- What to do
- Update Easy Digital Downloads to 3.1.0.5 or newer.
Jan 20, 2023The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of iCVE-2023-23489 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.
- Fixed in
- 3.1.0.4
- What to do
- Update the plugin to 3.1.0.4 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 21, 2022Easy Digital Downloads: Does not validate dataCVE-2022-3600 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.
- Product
- Easy Digital Downloads
- Fixed in
- 3.1.0.2
- What to do
- Update Easy Digital Downloads to 3.1.0.2 or newer.
Nov 14, 2022OAuth Client by DigitialPixies: Does not have CSRF checks in some placesCVE-2022-3632 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions.
- Product
- OAuth Client by DigitialPixies
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2022OAuth Client by DigitialPixies: Does not sanitize and escapes some of its settingsCVE-2022-3631 · WordPress plugins & themes · reported by WPScanMedium 4.8
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- OAuth Client by DigitialPixies
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 7, 2022Easy Digital Downloads: Does not have CSRF check in placeCVE-2022-2387 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
- Product
- Easy Digital Downloads
- Fixed in
- 3.0
- What to do
- Update Easy Digital Downloads to 3.0 or newer.
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress.CVE-2022-36798 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress.
- Affected
- up to 4.2.7
- What to do
- Affects up to 4.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 9, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at WordPress.CVE-2022-36356 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at WordPress.
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 22, 2022PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.CVE-2022-33900 · WordPress plugins & themes · reported by PatchstackMedium 4.1
PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 15, 2022Digital Publications by Supsystic: Does not sanitise and escape its settingsCVE-2022-2384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Digital Publications by Supsystic
- Fixed in
- 1.7.4
- What to do
- Update Digital Publications by Supsystic to 1.7.4 or newer.
Jul 17, 2022OAuth Single Sign On: Doesn't validate that OAuth access token requests are legitimateCVE-2022-2133 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.
- Product
- OAuth Single Sign On
- Fixed in
- 6.22.6
- What to do
- Update OAuth Single Sign On to 6.22.6 or newer.
May 25, 2022Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.CVE-2022-29408 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 18, 2022Easy Digital Downloads: Does not have CSRF check in placeCVE-2022-0707 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack
- Product
- Easy Digital Downloads
- Fixed in
- 2.11.6
- What to do
- Update Easy Digital Downloads to 2.11.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 18, 2022Easy Digital Downloads: Does not sanitise and escape the Downloadable File Name in the LogsCVE-2022-0706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Easy Digital Downloads
- Fixed in
- 2.11.6
- What to do
- Update Easy Digital Downloads to 2.11.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 21, 2021Easy Digital Downloads: Reflected Cross-Site ScriptingCVE-2021-39354 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.
- Product
- Easy Digital Downloads
- Affected
- up to 2.11.2
- What to do
- Affects up to 2.11.2. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
- Product
- WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2021Plus Addons for Elementor Page Builder: Did not properly check that a user requesting a password reset was the legitimate userCVE-2021-24359 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
- Product
- Plus Addons for Elementor Page Builder
- Fixed in
- 4.1.11
- What to do
- Update Plus Addons for Elementor Page Builder to 4.1.11 or newer.
Full record and what to do →NVD recordtheplusaddons.comwpscan.com
Sep 3, 2020The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege userCVE-2020-24948 · WordPress plugins & themes · reported by MITREHigh 7.2
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
- Fixed in
- 2.7.7
- What to do
- Update the plugin to 2.7.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Dec 27, 2019WordPress Xorbin Digital Flash Clock 1.0 has XSSCVE-2013-4693 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress Xorbin Digital Flash Clock 1.0 has XSS
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 23, 2019The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x bCVE-2015-9524 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1CVE-2015-9523 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1CVE-2015-9522 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2CVE-2015-9521 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.xCVE-2015-9520 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x beforeCVE-2015-9519 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x beforCVE-2015-9518 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x bCVE-2015-9517 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.CVE-2015-9516 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x beCVE-2015-9515 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x befCVE-2015-9514 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2CVE-2015-9513 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x beforeCVE-2015-9512 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2CVE-2015-9511 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Oct 23, 2019The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x CVE-2015-9510 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.