Updated 35 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

2,856 results · page 31 of 58

Nov 16, 2024AJAX Random Posts: Deserialization of Untrusted DataCVE-2024-52409 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Phoenixheart AJAX Random Posts ajax-random-posts allows Object Injection.This issue affects AJAX Random Posts: from n/a through <= 0.3.3.
Product
AJAX Random Posts
Affected
up to 0.3.3
What to do
Affects up to 0.3.3. Update AJAX Random Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 16, 2024404 Solution: Sensitive Information ExposureCVE-2024-11094 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. This makes it possible for unauthenticated attackers to extract data such as redirects including GET parameters which may reveal sensitive information. On most sites this is unlikely to be the case.
Product
404 Solution
Affected
up to 2.35.17
What to do
Affects up to 2.35.17. Update 404 Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 16, 2024Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX: Unauthorized plugin installation/activationCVE-2024-10728 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function in all versions up to, and including, 4.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
Product
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX
Affected
up to 4.1.16
What to do
Affects up to 4.1.16. Update Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024Popularis Extra: Information ExposureCVE-2024-10795 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Product
Popularis Extra
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Popularis Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Sensitive Information ExposureCVE-2024-8979 · WordPress plugins & themes · reported by WordfenceHigh 8
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_lostpassword_user_email_controls' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including usernames and passwords of any user, including Administrators, as long as that user opens the email notification for a password change request and images are not blocked by the email client.
Product
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.0.9
What to do
Affects up to 6.0.9. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders: Sensitive Information ExposureCVE-2024-8978 · WordPress plugins & themes · reported by WordfenceMedium 5.7
The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_register_user_email_controls' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Login | Register Form widget, as long as that user opens the email notification for successful registration.
Product
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.0.9
What to do
Affects up to 6.0.9. Update Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Boostify Header Footer Builder for Elementor: Information ExposureCVE-2024-10794 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.6 via the 'bhf' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Product
Boostify Header Footer Builder for Elementor
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Boostify Header Footer Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2024BuddyPress Builder for Elementor – BuddyBuilder: Information ExposureCVE-2024-10778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts crated by Elementor that they should not have access to.
Product
BuddyPress Builder for Elementor – BuddyBuilder
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update BuddyPress Builder for Elementor – BuddyBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 12, 2024RSS Feed Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-9836 · WordPress plugins & themes · reported by WPScanMedium 5.9
The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
RSS Feed Widget
Fixed in
3.0.0
What to do
Update RSS Feed Widget to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 11, 2024Futurio Extra: Information ExposureCVE-2024-10695 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts that they should not have access to.
Product
Futurio Extra
Affected
up to 2.0.13
What to do
Affects up to 2.0.13. Update Futurio Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2024Postcasa Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52352 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miloandrew Postcasa Shortcode postcasa allows DOM-Based XSS.This issue affects Postcasa Shortcode: from n/a through <= 1.0.
Product
Postcasa Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Postcasa Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 10, 2024Marquee Elementor with Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51584 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anas2004 Marquee Elementor with Posts marquee-elementor allows DOM-Based XSS.This issue affects Marquee Elementor with Posts: from n/a through <= 1.2.0.
Product
Marquee Elementor with Posts
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Marquee Elementor with Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Featured Posts Scroll: Cross-Site Request Forgery (CSRF)CVE-2024-51647 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll allows Stored XSS.This issue affects Featured Posts Scroll: from n/a through 1.25.
Product
Featured Posts Scroll
Affected
up to 1.25
What to do
Affects up to 1.25. Update Featured Posts Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Header Footer Composer for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51629 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MetricThemes Header Footer Composer for Elementor header-footer-composer allows DOM-Based XSS.This issue affects Header Footer Composer for Elementor: from n/a through <= 1.0.4.
Product
Header Footer Composer for Elementor
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Header Footer Composer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024MG Post Contributors: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51701 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Post Contributors mg-post-contributors allows Reflected XSS.This issue affects MG Post Contributors: from n/a through <= 1.3..
Product
MG Post Contributors
Affected
up to 1.3.
What to do
Affects up to 1.3.. Update MG Post Contributors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Magical Addons For Elementor: Sensitive Information ExposureCVE-2024-10352 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the get_content_type function in includes/widgets/content-reveal.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
Magical Addons For Elementor
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Forms: 3rd-Party Post Again: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51783 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zaus Forms: 3rd-Party Post Again forms-3rdparty-post-again allows Reflected XSS.This issue affects Forms: 3rd-Party Post Again: from n/a through <= 0.3.
Product
Forms: 3rd-Party Post Again
Affected
up to 0.3
What to do
Affects up to 0.3. Update Forms: 3rd-Party Post Again to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Attesa Extra: Information ExposureCVE-2024-10688 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Attesa Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.2 via the 'attesa-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Attesa Extra
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Attesa Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Quform - WordPress Form Builder: Sensitive Information ExposureCVE-2024-8756 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Quform - WordPress Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the 'saveUploadedFile' function. This makes it possible for unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users. Files uploaded via forms created before version 2.21.0 will remain vulnerable to exposure after upgrading. To fully patch the plugin, site administrators should download any previously uploaded files, delete previously existing files and forms, and create the forms again after upgrading to version 2.21.0.
Product
Quform - WordPress Form Builder
Affected
up to 2.20.0
What to do
Affects up to 2.20.0. Update Quform - WordPress Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 9, 2024Envo Extra: Information ExposureCVE-2024-10770 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Envo Extra
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update Envo Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Countdown Timer block – Display the event's date into a timer.: Information ExposureCVE-2024-10669 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the [ctb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Countdown Timer block – Display the event's date into a timer.
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Countdown Timer block – Display the event's date into a timer. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Content Slider Block: Information ExposureCVE-2024-10667 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Content Slider Block
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Content Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 8, 2024SKT Addons for Elementor: Information ExposureCVE-2024-10693 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.3 via the Unfold widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
SKT Addons for Elementor
Affected
up to 3.3
What to do
Affects up to 3.3. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 8, 2024Cowidgets – Elementor Addons: Information ExposureCVE-2024-10779 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'ce_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Cowidgets – Elementor Addons
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Cowidgets – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 6, 2024Event post: Stored Cross-Site ScriptingCVE-2024-10186 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode in all versions up to, and including, 5.9.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Event post
Affected
up to 5.9.6
What to do
Affects up to 5.9.6. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 5, 2024Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Sensitive Information ExposureCVE-2024-10028 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.13 via the exposed process stats file during the backup process. This makes it possible for unauthenticated attackers to obtain an archive file name and download the site's backup.
Product
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
Affected
up to 2.2.13
What to do
Affects up to 2.2.13. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 5, 2024Ultimate Bootstrap Elements for Elementor: Sensitive Information ExposureCVE-2024-10329 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the 'ube_get_page_templates' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the contents of templates that are private.
Product
Ultimate Bootstrap Elements for Elementor
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Ultimate Bootstrap Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2024140+ Widgets | Xpro Addons For Elementor – FREE: Sensitive Information ExposureCVE-2024-10319 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the render function in widgets/content-toggle/layout/frontend.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
140+ Widgets | Xpro Addons For Elementor – FREE
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update 140+ Widgets | Xpro Addons For Elementor – FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 5, 2024Post From Frontend: Does not have CSRF checkCVE-2024-9689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack
Product
Post From Frontend
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Post From Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 4, 2024Custom post type templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51683 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Custom post type templates for Elementor custom-post-type-templates-for-elementor allows Stored XSS.This issue affects Custom post type templates for Elementor: from n/a through <= 1.10.1.
Product
Custom post type templates for Elementor
Affected
up to 1.10.1
What to do
Affects up to 1.10.1. Update Custom post type templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2024Stacks Mobile App Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-50528 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Retrieve Embedded Sensitive Data.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Product
Stacks Mobile App Builder
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2024Multi Purpose Mail Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-50526 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.
Product
Multi Purpose Mail Form
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Multi Purpose Mail Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com github.com
Nov 4, 2024All Post Contact Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-50523 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through <= 1.8.2.
Product
All Post Contact Form
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update All Post Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Seraphinite Post .DOCX Source: Missing AuthorizationCVE-2024-38727 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seraphinite Post .DOCX Source: from n/a through 2.16.9.
Product
Seraphinite Post .DOCX Source
Affected
up to 2.16.9
What to do
Affects up to 2.16.9. Update Seraphinite Post .DOCX Source to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Auto Featured Image (Auto Post Thumbnail): Missing AuthorizationCVE-2024-38719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through 4.1.2.
Product
Auto Featured Image (Auto Post Thumbnail)
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024The Post Grid: Missing AuthorizationCVE-2024-37483 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.
Product
The Post Grid
Affected
up to 7.7.4
What to do
Affects up to 7.7.4. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024The Post Grid: Missing AuthorizationCVE-2024-37482 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.
Product
The Post Grid
Affected
up to 7.7.4
What to do
Affects up to 7.7.4. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024The Post Grid: Missing AuthorizationCVE-2024-37481 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.
Product
The Post Grid
Affected
up to 7.7.4
What to do
Affects up to 7.7.4. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 30, 2024Woo Manage Fraud Orders: Sensitive Information ExposureCVE-2024-10544 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.
Product
Woo Manage Fraud Orders
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Woo Manage Fraud Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 30, 2024Posti Shipping: Generation of Error Message Containing Sensitive InformationCVE-2024-50512 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Generation of Error Message Containing Sensitive Information vulnerability in Posti Posti Shipping posti-shipping allows Retrieve Embedded Sensitive Data.This issue affects Posti Shipping: from n/a through <= 3.10.2.
Product
Posti Shipping
Affected
up to 3.10.2
What to do
Affects up to 3.10.2. Update Posti Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024WP Booking System: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-50425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects WP Booking System: from n/a through <= 2.0.19.10.
Product
WP Booking System
Affected
up to 2.0.19.10
What to do
Affects up to 2.0.19.10. Update WP Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Move Addons for Elementor: Sensitive Information ExposureCVE-2024-10360 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the render function in includes/widgets/accordion/widget.php, includes/widgets/remote-template/widget.php, and other widget.php files. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
Move Addons for Elementor
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Move Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 29, 2024Post Status Notifier Lite and Premium: Reflected Cross-Site ScriptingCVE-2024-10048 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Post Status Notifier Lite and Premium plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.11.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Post Status Notifier Lite and Premium
Affected
up to 1.11.6
What to do
Affects up to 1.11.6. Update Post Status Notifier Lite and Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 29, 2024Multi Purpose Mail Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-50484 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.
Product
Multi Purpose Mail Form
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Multi Purpose Mail Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Exclusive Addons for Elementor: Sensitive Information ExposureCVE-2024-10312 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.4 via the render function in elements/tabs/tabs.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
Exclusive Addons for Elementor
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update Exclusive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 28, 2024Post Grid and Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50432 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Cross-Site Scripting (XSS).This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.2.93.
Product
Post Grid and Gutenberg Blocks
Affected
up to 2.2.93
What to do
Affects up to 2.2.93. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024Kodex Posts likes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50464 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes kodex-posts-likes.This issue affects Kodex Posts likes: from n/a through <= 2.5.0.
Product
Kodex Posts likes
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Kodex Posts likes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50443 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.12.
Product
PostX
Affected
up to 4.1.12
What to do
Affects up to 4.1.12. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2024Clever Addons for Elementor: Sensitive Information ExposureCVE-2024-10357 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Clever Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.1 via the getTemplateContent function in src/widgets/class-clever-widget-base.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
Clever Addons for Elementor
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Clever Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 26, 2024WordPress Post Grid Layouts with Pagination – Sogrid: Local File InclusionCVE-2024-8392 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress Post Grid Layouts with Pagination – Sogrid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.6 via the 'tab' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This can also be exploited via CSRF techniques.
Product
WordPress Post Grid Layouts with Pagination – Sogrid
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update WordPress Post Grid Layouts with Pagination – Sogrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.