Updated 55 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

5,764 results · page 32 of 116

Aug 16, 2024Theme My Login: Cross-Site Request ForgeryCVE-2024-7422 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note that this only affects multi-site instances.
Product
Theme My Login
Affected
up to 7.1.7
What to do
Affects up to 7.1.7. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 12, 2024WooCommerce - Social Login: Authentication bypassCVE-2024-7503 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'woo_slg_confirm_email_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the userID. This requires the email module to be enabled.
Product
WooCommerce - Social Login
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Aug 12, 2024Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget: Does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the WCVE-2024-6158 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget
Fixed in
4.9.17
What to do
Update Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget to 4.9.17 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2024Lightbox & Modal Popup WordPress Plugin – FooBox: DOM-based Stored Cross-Site ScriptingCVE-2024-5668 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 2.7.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lightbox & Modal Popup WordPress Plugin – FooBox
Affected
up to 2.7.28
What to do
Affects up to 2.7.28. Update Lightbox & Modal Popup WordPress Plugin – FooBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 7, 2024Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress: Authentication bypassCVE-2024-7350 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1.6 to 1.1.7. This is due to the plugin not properly verifying a user's identity prior to logging them in when completing a booking. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they have access to that user's email. This is only exploitable when the 'Auto login user after successful booking' setting is enabled.
Product
Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress
Affected
1.1.6 to 1.1.7
What to do
Affects 1.1.6 to 1.1.7. Update Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2024Cooked is a recipe plugin for WordPress.CVE-2024-41816 · WordPress plugins & themes · reported by GitHubMedium 5.4
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Aug 2, 2024WordPress Menu Plugin — Superfly Responsive Menu: Cross-Site Request ForgeryCVE-2024-3238 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Menu Plugin — Superfly Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.29. This is due to missing or incorrect nonce validation on the ajax_handle_delete_icons() function. This makes it possible for unauthenticated attackers to delete arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please not the CSRF was patched in 5.0.28, however, adequate directory traversal protection wasn't introduced until 5.0.30.
Product
WordPress Menu Plugin — Superfly Responsive Menu
Affected
up to 5.0.29
What to do
Affects up to 5.0.29. Update WordPress Menu Plugin — Superfly Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Aug 1, 2024Photo Engine: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39660 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jordy Meow Photo Engine allows Stored XSS.This issue affects Photo Engine: from n/a through 6.3.1.
Product
Photo Engine
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Photo Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024AI Engine: ChatGPT Chatbot: Server-Side Request Forgery (SSRF)CVE-2024-38791 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.
Product
AI Engine: ChatGPT Chatbot
Affected
up to 2.4.7
What to do
Affects up to 2.4.7. Update AI Engine: ChatGPT Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Backup and Staging by WP Time Capsule: Improper Privilege ManagementCVE-2024-38770 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.20.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.20
What to do
Affects up to 1.22.20. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024FundEngine: Privilege escalationCVE-2024-6698 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the update_user_meta function. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta which can be leveraged to update their capabilities to gain administrator access.
Product
FundEngine
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update FundEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 31, 2024Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2024-6725 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in all versions up to, and including, 6.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with form editing permissions and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Affected
up to 6.11.1
What to do
Affects up to 6.11.1. Update Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 30, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-5901 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including, 1.62.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SiteOrigin Widgets Bundle
Affected
up to 1.62.2
What to do
Affects up to 1.62.2. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 29, 2024The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PCVE-2024-5882 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PHP files on the server from the listings page
Product
Ultimate Classified Listings
Fixed in
1.3
What to do
Update Ultimate Classified Listings to 1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6703 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.19
What to do
Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6521 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dropdown fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.19
What to do
Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6520 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom error message in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.19
What to do
Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6518 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via input fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.19
What to do
Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 26, 2024During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests oCVE-2024-6490 · WordPress plugins & themes · reported by WPScanMedium 6.5
During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider WordPress plugin through 3.9.10.
Product
Master Slider
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 24, 2024The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPressCVE-2024-6836 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and including, 3.4.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to update multiple settings, including templates, designs, checkouts, and other plugin settings.
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2024Hide My WP Ghost: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2024-6420 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
Product
Hide My WP Ghost
Fixed in
5.2.02
What to do
Update Hide My WP Ghost to 5.2.02 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 23, 2024Page Builder Gutenberg Blocks: Does not prevent users from pinging arbitrary hosts via some of its shortcodesCVE-2024-4260 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
Product
Page Builder Gutenberg Blocks
Fixed in
3.1.12
What to do
Update Page Builder Gutenberg Blocks to 3.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 22, 2024Login with phone number: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37429 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.35.
Product
Login with phone number
Affected
up to 1.7.35
What to do
Affects up to 1.7.35. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024CM Popup Plugin for WordPress: Does not sanitise and escape some of the campaign settingsCVE-2024-5004 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Product
CM Popup Plugin for WordPress
Fixed in
1.6.6
What to do
Update CM Popup Plugin for WordPress to 1.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 21, 2024Save as PDF plugin by Pdfcrowd: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37549 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 4.0.0.
Product
Save as PDF plugin by Pdfcrowd
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Save as PDF plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 21, 2024Login Logo Editor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37523 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AMP-MODE Login Logo Editor allows Stored XSS.This issue affects Login Logo Editor: from n/a through 1.3.3.
Product
Login Logo Editor
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Login Logo Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024Plugin Notes Plus: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37561 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jamie Bergen Plugin Notes Plus allows Stored XSS.This issue affects Plugin Notes Plus: from n/a through 1.2.6.
Product
Plugin Notes Plus
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Plugin Notes Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024SEO Plugin by Squirrly SEO: Stored Cross-Site ScriptingCVE-2024-6497 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 12.3.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-43286 appears to be a duplicate of this issue.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.3.19
What to do
Affects up to 12.3.19. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 20, 2024WP Travel Engine: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37944 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1.
Product
WP Travel Engine
Affected
up to 5.9.1
What to do
Affects up to 5.9.1. Update WP Travel Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024WooCommerce - Social Login: Unauthenticated privilege escalationCVE-2024-6637 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.
Product
WooCommerce - Social Login
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 20, 2024WooCommerce - Social Login: Unauthorized modification of dataCVE-2024-6636 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_email' function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to change the default role to Administrator while registering for an account.
Product
WooCommerce - Social Login
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 20, 2024WooCommerce - Social Login: Authentication bypassCVE-2024-6635 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user.
Product
WooCommerce - Social Login
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Insecure Direct Object ReferenceCVE-2024-5977 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2024Cooked is a recipe plugin for WordPress.CVE-2024-39682 · WordPress plugins & themes · reported by GitHubMedium 6.4
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary HTML in pages that will be shown whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
up to 1.7.15.4
What to do
Affects up to 1.7.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 17, 2024Cooked is a recipe plugin for WordPress.CVE-2024-39681 · WordPress plugins & themes · reported by GitHubMedium 5.4
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
up to 1.7.15.4
What to do
Affects up to 1.7.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 17, 2024Cooked is a recipe plugin for WordPress.CVE-2024-39680 · WordPress plugins & themes · reported by GitHubMedium 5.4
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
up to 1.7.15.4
What to do
Affects up to 1.7.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 17, 2024Cooked is a recipe plugin for WordPress.CVE-2024-39679 · WordPress plugins & themes · reported by GitHubMedium 4.3
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
up to 1.7.15.4
What to do
Affects up to 1.7.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 17, 2024Cooked is a recipe plugin for WordPress.CVE-2024-39678 · WordPress plugins & themes · reported by GitHubMedium 4.3
Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
up to 1.7.15.4
What to do
Affects up to 1.7.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 17, 2024BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Unauthorized modification of data that can lead to privilege escalationCVE-2024-6660 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the bookingpress_import_data_continue_process_func function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site and upload arbitrary files. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2024BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Arbitrary File Read to Arbitrary File CreationCVE-2024-6467 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File Creation in all versions up to, and including, 1.1.5 via the 'bookingpress_save_lite_wizard_settings_func' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary files that contain the content of files (either on the local server or from a remote location), allowing the execution of any PHP code in those files or the exposure of sensitive information.
Product
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 16, 2024RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging: Unauthorized modification of dataCVE-2024-6621 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprss_activate_feed_source' and 'wprss_pause_feed_source' functions in all versions up to, and including, 4.23.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or pause existing RSS feeds.
Product
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
Affected
up to 4.23.11
What to do
Affects up to 4.23.11. Update RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2024Web and WooCommerce Addons for WPBakery Builder: Unauthorized plugin settings modificationCVE-2024-6579 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress is vulnerable to unauthorized plugin settings modification due to a missing capability check on several plugin functions in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change some of the plugin settings.
Product
Web and WooCommerce Addons for WPBakery Builder
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Web and WooCommerce Addons for WPBakery Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2024The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnCVE-2024-6557 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and leaving the demo files in place with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 15, 2024WPS Hide Login: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2024-6289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
Product
WPS Hide Login
Fixed in
1.9.16.4
What to do
Update WPS Hide Login to 1.9.16.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some parametersCVE-2024-3026 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
Product
WordPress Button Plugin MaxButtons
Fixed in
9.7.8
What to do
Update WordPress Button Plugin MaxButtons to 9.7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024PowerPress Podcasting plugin by Blubrry: Reflected Cross-Site ScriptingCVE-2024-6588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘media_url’ parameter in all versions up to, and including, 11.9.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PowerPress Podcasting plugin by Blubrry
Affected
up to 11.9.10
What to do
Affects up to 11.9.10. Update PowerPress Podcasting plugin by Blubrry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2024Image Optimizer, Resizer and CDN – Sirv: Unauthorized plugin settings modificationCVE-2024-6392 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.7
What to do
Affects up to 7.2.7. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2024Feeds for YouTube (YouTube video, channel, and gallery plugin): Stored Cross-Site ScriptingCVE-2024-6256 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Feeds for YouTube (YouTube video, channel, and gallery plugin)
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Feeds for YouTube (YouTube video, channel, and gallery plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2024Branda – White Label WordPress, Custom Login Page Customizer: Full Path DisclosureCVE-2024-6554 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Branda – White Label WordPress, Custom Login Page Customizer
Affected
up to 3.4.18
What to do
Affects up to 3.4.18. Update Branda – White Label WordPress, Custom Login Page Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2024InstaWP Connect – 1-click WP Staging & Migration: Authentication bypassCVE-2024-6397 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.44
Fixed in
0.1.0.44
What to do
Update InstaWP Connect – 1-click WP Staging & Migration to 0.1.0.44 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.