Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

1,978 results · page 32 of 40

Mar 29, 2024MasterStudy LMS: Local File InclusionCVE-2024-2411 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
MasterStudy LMS
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com plugins.trac.wordpress.org
Mar 29, 2024MasterStudy LMS: Privilege EscalationCVE-2024-2409 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.
Product
MasterStudy LMS
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com plugins.trac.wordpress.org
Mar 28, 2024DecaLog: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30245 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pierre Lannoy DecaLog decalog.This issue affects DecaLog: from n/a through <= 3.9.0.
Product
DecaLog
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update DecaLog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Calendarista: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30240 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Typps Calendarista.This issue affects Calendarista: from n/a through 15.5.7.
Product
Calendarista
Affected
up to 15.5.7
What to do
Affects up to 15.5.7. Update Calendarista to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Events Manager – Calendar, Bookings, Tickets, and more!: Stored Cross-Site ScriptingCVE-2024-2111 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value in all versions up to, and including, 6.4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 6.4.7.1
What to do
Affects up to 6.4.7.1. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024Events Manager – Calendar, Bookings, Tickets, and more!: Cross-Site Request ForgeryCVE-2024-2110 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers to modify booking statuses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Events Manager – Calendar, Bookings, Tickets, and more!
Affected
up to 6.4.7.1
What to do
Affects up to 6.4.7.1. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024Calculated Fields Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.This issue affects Calculated Fields Form: from n/a through 1.2.54.
Product
Calculated Fields Form
Affected
up to 1.2.54
What to do
Affects up to 1.2.54. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024iCalendrier: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29912 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baptiste Placé iCalendrier allows Stored XSS.This issue affects iCalendrier: from n/a through 1.80.
Product
iCalendrier
Affected
up to 1.80
What to do
Affects up to 1.80. Update iCalendrier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024The Plus Addons for Elementor: Local File InclusionCVE-2024-2210 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Team Member Listing widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
The Plus Addons for Elementor
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update The Plus Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2024The Plus Addons for Elementor: Local File InclusionCVE-2024-2203 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
The Plus Addons for Elementor
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update The Plus Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2024The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29832 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 6.1
The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29810 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29809 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29808 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024Calliope: Cross-Site Request Forgery (CSRF)CVE-2024-2904 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33.
Product
Calliope
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update Calliope to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-23991 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdevelop / Oplugins Booking Calendar allows SQL Injection.This issue affects Booking Calendar: from n/a through 9.4.3.
Product
Booking Calendar
Affected
up to 9.4.3
What to do
Affects up to 9.4.3. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024Calendarista Basic Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.
Product
Calendarista Basic Edition
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Appointment Booking Calendar: Does not have CSRF checks in some placesCVE-2024-0856 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.
Product
Appointment Booking Calendar
Fixed in
1.3.83
What to do
Update Appointment Booking Calendar to 1.3.83 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 19, 2024WP Calameo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29098 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calameo WP Calameo allows Stored XSS.This issue affects WP Calameo: from n/a through 2.1.7.
Product
WP Calameo
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update WP Calameo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2024Scalable Vector Graphics (SVG): Does not sanitize uploaded SVG filesCVE-2023-7085 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
Scalable Vector Graphics (SVG)
Affected
up to 3.4
What to do
Affects up to 3.4. Update Scalable Vector Graphics (SVG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 15, 2024WP Simple Booking Calendar: Cross-Site Request Forgery (CSRF)CVE-2023-51525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Veribo, Roland Murg WP Simple Booking Calendar.This issue affects WP Simple Booking Calendar: from n/a through 2.0.8.4.
Product
WP Simple Booking Calendar
Affected
up to 2.0.8.4
What to do
Affects up to 2.0.8.4. Update WP Simple Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024My Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25916 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joseph C Dolson My Calendar allows Stored XSS.This issue affects My Calendar: from n/a through 3.4.23.
Product
My Calendar
Affected
up to 3.4.23
What to do
Affects up to 3.4.23. Update My Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing caCVE-2024-2172 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator.
Affected
up to 4.7.2
What to do
Affects up to 4.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Calculated Fields Form: Stored Cross-Site ScriptingCVE-2024-2020 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the professional version or higher.
Product
Calculated Fields Form
Affected
up to 5.1.56
What to do
Affects up to 5.1.56. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 13, 2024Academy LMS – eLearning and online course solution for: Privilege escalationCVE-2024-1505 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator.
Product
Academy LMS – eLearning and online course solution for
Affected
up to 1.9.19
What to do
Affects up to 1.9.19. Update Academy LMS – eLearning and online course solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024Booking for Appointments and Events Calendar – Amelia: Reflected Cross-Site ScriptingCVE-2024-1484 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date parameters in all versions up to, and including, 1.0.98 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 1.0.98
What to do
Affects up to 1.0.98. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024EventPrime – Events Calendar, Bookings and Tickets: Payment bypassCVE-2024-1321 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for unauthenticated attackers to book events for free.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-1127 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the booking_export_all() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve all event booking which can contain PII.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access of dataCVE-2024-1126 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_attendees_email_by_event_id() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to to retrieve the attendees list for any event.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Reflected Cross-Site ScriptingCVE-2024-0976 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the plugin parameter in all versions up to, and including, 3.1.41 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Affected
up to 3.1.41
What to do
Affects up to 3.1.41. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: Stored Cross-Site ScriptingCVE-2024-0898 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
Affected
up to 2.3
What to do
Affects up to 2.3. Update Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Stored Cross-Site ScriptingCVE-2024-1320 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'offline_status' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized loss of dataCVE-2024-1125 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized email sendingCVE-2024-1124 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 9, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized modification of dataCVE-2024-1123 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_frontend_event_submission() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary posts. This can also be exploited by unauthenticated attackers when the allow_submission_by_anonymous_user setting is enabled.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2024Restaurant Reservations: Local File InclusionCVE-2024-1382 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Restaurant Reservations plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the nd_rst_layout attribute of the nd_rst_search shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where an uploaded PHP file may not be directly accessible.
Product
Restaurant Reservations
Affected
up to 1.9
What to do
Affects up to 1.9. Update Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 6, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: Cross-Site Request ForgeryCVE-2024-1760 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. This is due to missing or incorrect nonce validation on the ssa_factory_reset() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.6.20
What to do
Affects up to 1.6.6.20. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-0821 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'section' parameter in all versions up to, and including, 3.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Matomo Analytics – Ethical Stats. Powerful Insights.: Reflected Cross-Site ScriptingCVE-2023-6923 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Matomo Analytics – Ethical Stats. Powerful Insights.
Affected
up to 4.15.3
What to do
Affects up to 4.15.3. Update Matomo Analytics – Ethical Stats. Powerful Insights. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024Spiffy Calendar: Doesn't check the event_author parameterCVE-2024-0855 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
Product
Spiffy Calendar
Fixed in
4.9.9
What to do
Update Spiffy Calendar to 4.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 12, 2024Analytics Insights for Google Analytics 4 (AIWP): Is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callbackCVE-2024-0250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
Analytics Insights for Google Analytics 4 (AIWP)
Fixed in
6.3
What to do
Update Analytics Insights for Google Analytics 4 (AIWP) to 6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 10, 2024CC BMI Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-23516 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calculators World CC BMI Calculator allows Stored XSS.This issue affects CC BMI Calculator: from n/a through 2.0.1.
Product
CC BMI Calculator
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update CC BMI Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 9, 2024Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin: Unauthorized access of dataCVE-2024-1122 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data.
Product
Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin
Affected
up to 3.3.50
What to do
Affects up to 3.3.50. Update Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 8, 2024WP Booking Calendar: SQL InjectionCVE-2024-1207 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Booking Calendar
Affected
up to 9.9
What to do
Affects up to 9.9. Update WP Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2024Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline): Stored Cross-Site ScriptingCVE-2024-0977 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image URLs in the plugin's timeline widget in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, changes the slideshow type, and then changes it back to an image.
Product
Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline)
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-0660 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.7.2. This is due to missing or incorrect nonce validation on the update_settings function. This makes it possible for unauthenticated attackers to change form settings and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Affected
up to 6.7.2
What to do
Affects up to 6.7.2. Update Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Shield Security – Smart Bot Blocking & Intrusion Prevention Security: Local File InclusionCVE-2023-6989 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
Product
Shield Security – Smart Bot Blocking & Intrusion Prevention Security
Affected
up to 18.5.9
What to do
Affects up to 18.5.9. Update Shield Security – Smart Bot Blocking & Intrusion Prevention Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Booking for Appointments and Events Calendar – Amelia: Stored Cross-Site ScriptingCVE-2023-6808 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 1.0.93
What to do
Affects up to 1.0.93. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024The Events Calendar: Sensitive Information ExposureCVE-2023-6557 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data including post titles and IDs of pending, private and draft posts.
Product
The Events Calendar
Affected
up to 6.2.8.2
What to do
Affects up to 6.2.8.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024CalculatorPro Calculators: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24847 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgadbois CalculatorPro Calculators allows Reflected XSS.This issue affects CalculatorPro Calculators: from n/a through 1.1.7.
Product
CalculatorPro Calculators
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update CalculatorPro Calculators to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.