Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,844 results · page 31 of 57
Dec 14, 2024Visualmodo Elements: Stored Cross-Site ScriptingCVE-2024-11095 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visualmodo Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Visualmodo Elements
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Visualmodo Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 13, 2024Hello Event Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54338 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in christer_f Hello Event Widgets For Elementor hello-event-widgets-for-elementor allows DOM-Based XSS.This issue affects Hello Event Widgets For Elementor: from n/a through <= 1.0.2.
- Product
- Hello Event Widgets For Elementor
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Hello Event Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Restaurant & Cafe Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54316 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows DOM-Based XSS.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through <= 1.5.8.
- Product
- Restaurant & Cafe Addon for Elementor
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Events Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54315 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-elementor allows DOM-Based XSS.This issue affects Events Addon for Elementor: from n/a through <= 2.2.2.
- Product
- Events Addon for Elementor
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Events Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Primary Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54314 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.6.0.
- Product
- Primary Addon for Elementor
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Hive Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54304 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hive Support Hive Support hive-support allows SQL Injection.This issue affects Hive Support: from n/a through <= 1.1.2.
- Product
- Hive Support
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Appsplate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54292 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsplate Appsplate appsplate allows SQL Injection.This issue affects Appsplate: from n/a through <= 2.1.3.
- Product
- Appsplate
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Appsplate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024News Ticker for Elementor: Missing AuthorizationCVE-2024-54278 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through <= 2.1.3.
- Product
- News Ticker for Elementor
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update News Ticker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024TAX SERVICE Electronic HDM: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54261 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM virtual-hdm-for-taxservice-am allows SQL Injection.This issue affects TAX SERVICE Electronic HDM: from n/a through <= 1.2.2.
- Product
- TAX SERVICE Electronic HDM
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update TAX SERVICE Electronic HDM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Ni CRM Lead: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54258 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows SQL Injection.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
- Product
- Ni CRM Lead
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Limit Login Attempts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54234 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.
- Product
- Limit Login Attempts
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Booster Elementor Addons: Missing AuthorizationCVE-2023-38480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Certain Dev Booster Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster Elementor Addons: from n/a through 1.4.9.
- Product
- Booster Elementor Addons
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Booster Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Dynamic Visibility for Elementor: Missing AuthorizationCVE-2023-35046 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dynamic.ooo Dynamic Visibility for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamic Visibility for Elementor: from n/a through 5.0.5.
- Product
- Dynamic Visibility for Elementor
- Affected
- up to 5.0.5
- What to do
- Affects up to 5.0.5. Update Dynamic Visibility for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Stored Cross-Site ScriptingCVE-2024-10784 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery' widget in all versions up to, and including, 1.5.126 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 1.5.126
- What to do
- Affects up to 1.5.126. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024ElementInvader Addons for Elementor: Sensitive Information ExposureCVE-2024-12059 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the eli_option_value shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract arbitrary options from the wp_options table.
- Product
- ElementInvader Addons for Elementor
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2024News Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54260 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
- Product
- News Kit Elementor Addons
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Xpro Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54253 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.6.5.
- Product
- Xpro Elementor Addons
- Affected
- up to 1.4.6.5
- What to do
- Affects up to 1.4.6.5. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024ABCBiz Addons and Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54247 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABCBiz ABCBiz Addons and Templates for Elementor allows Stored XSS.This issue affects ABCBiz Addons and Templates for Elementor: from n/a through 2.0.2.
- Product
- ABCBiz Addons and Templates for Elementor
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update ABCBiz Addons and Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024RRAddons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54232 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RRDevs RRAddons for Elementor rrdevs-for-elementor allows Stored XSS.This issue affects RRAddons for Elementor: from n/a through <= 1.1.0.
- Product
- RRAddons for Elementor
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update RRAddons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Unlock Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54230 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masud Hasan Unlock Addons for Elementor unlock-addons-for-elementor allows DOM-Based XSS.This issue affects Unlock Addons for Elementor: from n/a through <= 2.2.4.
- Product
- Unlock Addons for Elementor
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Unlock Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Wot Elementor Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54228 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Wot Elementor Widgets wot-elementor-widgets allows DOM-Based XSS.This issue affects Wot Elementor Widgets: from n/a through <= 1.0.1.
- Product
- Wot Elementor Widgets
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Wot Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024ElementsReady Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54224 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows DOM-Based XSS.This issue affects ElementsReady Addons for Elementor: from n/a through <= 6.4.7.
- Product
- ElementsReady Addons for Elementor
- Affected
- up to 6.4.7
- What to do
- Affects up to 6.4.7. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Revy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54215 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy.This issue affects Revy: from n/a through <= 1.18.
- Product
- Revy
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Revy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Tutor LMS Elementor Addons: Missing AuthorizationCVE-2024-53816 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issue affects Tutor LMS Elementor Addons: from n/a through <= 2.1.5.
- Product
- Tutor LMS Elementor Addons
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Tutor LMS Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024My Sticky Elements: Missing AuthorizationCVE-2023-51362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.1.3.
- Product
- My Sticky Elements
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update My Sticky Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024LA-Studio Element Kit for Elementor: Missing AuthorizationCVE-2023-50884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.1.5.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Elementor Timeline Widget: Missing AuthorizationCVE-2023-49755 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in B.M. Rafiul Alam Elementor Timeline Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Timeline Widget: from n/a through 2.2.
- Product
- Elementor Timeline Widget
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Elementor Timeline Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Void Elementor Post Grid Addon for Elementor Page builder: Missing AuthorizationCVE-2023-48750 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in voidthemes Void Elementor Post Grid Addon for Elementor Page builder void-elementor-post-grid-addon-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through <= 2.1.10.
- Product
- Void Elementor Post Grid Addon for Elementor Page builder
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update Void Elementor Post Grid Addon for Elementor Page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Restaurant & Cafe Addon for Elementor: Missing AuthorizationCVE-2023-47826 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NicheAddons Restaurant & Cafe Addon for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through 1.5.3.
- Product
- Restaurant & Cafe Addon for Elementor
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Rife Elementor Extensions & Templates: Missing AuthorizationCVE-2023-27454 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apollo13Themes Rife Elementor Extensions & Templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rife Elementor Extensions & Templates: from n/a through 1.1.10.
- Product
- Rife Elementor Extensions & Templates
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Rife Elementor Extensions & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 7, 2024Smoove connector for Elementor forms: Reflected Cross-Site ScriptingCVE-2024-11367 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smoove connector for Elementor forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Smoove connector for Elementor forms
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Smoove connector for Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2024Magical Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54212 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.3.6.
- Product
- Magical Addons For Elementor
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Advanced Element Bucket Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54210 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codexshaper Advanced Element Bucket Addons for Elementor cs-element-bucket allows Stored XSS.This issue affects Advanced Element Bucket Addons for Elementor: from n/a through <= 1.0.2.
- Product
- Advanced Element Bucket Addons for Elementor
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Advanced Element Bucket Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53823 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows DOM-Based XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.14.
- Product
- The Plus Addons for Elementor Page Builder Lite
- Affected
- up to 5.6.14
- What to do
- Affects up to 5.6.14. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Product Labels For Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53817 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Product Labels For Woocommerce aco-product-labels-for-woocommerce allows Blind SQL Injection.This issue affects Product Labels For Woocommerce: from n/a through <= 1.5.8.
- Product
- Product Labels For Woocommerce
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Product Labels For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Pinpoint Booking System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53815 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Blind SQL Injection.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.1.
- Product
- Pinpoint Booking System
- Affected
- up to 2.9.9.5.1
- What to do
- Affects up to 2.9.9.5.1. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024NEX-Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53808 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows SQL Injection.This issue affects NEX-Forms: from n/a through <= 8.7.8.
- Product
- NEX-Forms
- Affected
- up to 8.7.8
- What to do
- Affects up to 8.7.8. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WP Mailster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53807 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brandtoss WP Mailster wp-mailster allows Blind SQL Injection.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
- Product
- WP Mailster
- Affected
- up to 1.8.16.0
- What to do
- Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53796 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows DOM-Based XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.2.2.
- Product
- themesflat-addons-for-elementor
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WordPress Auction: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51615 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows SQL Injection.This issue affects WordPress Auction Plugin: from n/a through <= 3.7.
- Product
- WordPress Auction
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Gold Addons for Elementor: Unauthorized modification of dataCVE-2024-12110 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gold Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate() and deactivate() functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate and deactivate licenses.
- Product
- Gold Addons for Elementor
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Gold Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024PowerPack Elementor Addons (Free Widgets, Extensions and Templates): Information ExposureCVE-2024-10692 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 via the Content Reveal widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
- Product
- PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update PowerPack Elementor Addons (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024XLTab – Accordions and Tabs for Elementor Page Builder: Information ExposureCVE-2024-10689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The XLTab – Accordions and Tabs for Elementor Page Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4 via the 'XLTAB_INSERT_TPL' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
- Product
- XLTab – Accordions and Tabs for Elementor Page Builder
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update XLTab – Accordions and Tabs for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 5, 2024AnyWhere Elementor: Information ExposureCVE-2024-10777 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
- Product
- AnyWhere Elementor
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 4, 2024FAT Services Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54221 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking.This issue affects FAT Services Booking: from n/a through <= 5.6.
- Product
- FAT Services Booking
- Affected
- up to 5.6
- What to do
- Affects up to 5.6. Update FAT Services Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 4, 2024WPBITS Addons For Elementor Page Builder: Stored Cross-Site ScriptingCVE-2024-8962 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- WPBITS Addons For Elementor Page Builder
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update WPBITS Addons For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 4, 2024LA-Studio Element Kit for Elementor: Information ExposureCVE-2024-10787 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created by Elementor that they should not have access to.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 3, 2024Eleblog – Elementor Blog And Magazine Addons: Unauthorized modification of dataCVE-2024-10663 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Eleblog – Elementor Blog And Magazine Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the goodbye_form_callback() function in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit a deactivation reason.
- Product
- Eleblog – Elementor Blog And Magazine Addons
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Eleblog – Elementor Blog And Magazine Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 3, 2024Charity Addon for Elementor: Information ExposureCVE-2024-12062 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.3 via the 'nacharity_elementor_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
- Product
- Charity Addon for Elementor
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Charity Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 3, 2024Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows): Stored Cross-Site ScriptingCVE-2024-9058 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lightbox widget in all versions up to, and including, 5.10.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
- Affected
- up to 5.10.5
- What to do
- Affects up to 5.10.5. Update Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.