Updated 59 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,813 results · page 33 of 57

Jan 7, 2025Multiple Shipping And Billing Address For Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56290 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows SQL Injection.This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through <= 1.2.
Product
Multiple Shipping And Billing Address For Woocommerce
Affected
up to 1.2
What to do
Affects up to 1.2. Update Multiple Shipping And Billing Address For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025SSL Wireless SMS Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56284 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows SQL Injection.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.5.0.
Product
SSL Wireless SMS Notification
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025ClickWhale: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51715 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickWhale ClickWhale clickwhale allows Blind SQL Injection.This issue affects ClickWhale: from n/a through <= 2.4.1.
Product
ClickWhale
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025School Management System – SakolaWP: Privilege escalationCVE-2024-12470 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to the registration function not properly limiting what roles a user can register as. This makes it possible for unauthenticated attackers to register as an administrative user.
Product
School Management System – SakolaWP
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update School Management System – SakolaWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 7, 2025School Management System – WPSchoolPress: SQL InjectionCVE-2024-12332 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Student/Parent-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
School Management System – WPSchoolPress
Affected
up to 2.2.14
What to do
Affects up to 2.2.14. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Simple Video Management System: Reflected Cross-Site ScriptingCVE-2024-12256 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Video Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'analytics_video' parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Simple Video Management System
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Simple Video Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 4, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: SQL InjectionCVE-2024-12195 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, who have been granted access to a project, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Affected
up to 2.6.16
What to do
Affects up to 2.6.16. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025Taskbuilder – WordPress Project & Task Management: Stored Cross-Site ScriptingCVE-2024-11930 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shortcode in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Taskbuilder – WordPress Project & Task Management
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update Taskbuilder – WordPress Project & Task Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025WP Compress – Instant Performance & Speed Optimization: Reflected Cross-Site ScriptingCVE-2024-12047 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Compress – Instant Performance & Speed Optimization
Affected
up to 6.30.03
What to do
Affects up to 6.30.03. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025WP Table Manager: Missing AuthorizationCVE-2022-47601 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in JoomUnited WP Table Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Table Manager: from n/a through 3.5.2.
Product
WP Table Manager
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update WP Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WP Job Manager - Resume Manager: Cross-Site Request Forgery (CSRF)CVE-2024-37241 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager - Resume Manager allows Cross Site Request Forgery.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.
Product
WP Job Manager - Resume Manager
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Job Manager - Resume Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Just Writing Statistics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56250 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows SQL Injection.This issue affects Just Writing Statistics: from n/a through <= 4.7.
Product
Just Writing Statistics
Affected
up to 4.7
What to do
Affects up to 4.7. Update Just Writing Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WP Post Author: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56247 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows SQL Injection.This issue affects WP Post Author: from n/a through <= 3.8.2.
Product
WP Post Author
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Swift Performance Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37511 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in swte Swift Performance Lite swift-performance-lite allows Cross Site Request Forgery.This issue affects Swift Performance Lite: from n/a through <= 2.3.6.20.
Product
Swift Performance Lite
Affected
up to 2.3.6.20
What to do
Affects up to 2.3.6.20. Update Swift Performance Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Freesoul Deactivate Plugins – Plugin manager and cleanup: Missing AuthorizationCVE-2023-46188 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Freesoul Deactivate Plugins – Plugin manager and cleanup: from n/a through 2.1.3.
Product
Freesoul Deactivate Plugins – Plugin manager and cleanup
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Freesoul Deactivate Plugins – Plugin manager and cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025ApplyOnline – Application Form Builder and Manager: Missing AuthorizationCVE-2023-46080 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Farhan Noor ApplyOnline – Application Form Builder and Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline – Application Form Builder and Manager: from n/a through 2.5.3.
Product
ApplyOnline – Application Form Builder and Manager
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update ApplyOnline – Application Form Builder and Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Smart Manager: Missing AuthorizationCVE-2024-49687 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through <= 8.45.0.
Product
Smart Manager
Affected
up to 8.45.0
What to do
Affects up to 8.45.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024WPLMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56042 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
Product
WPLMS
Fixed in
1.9.9.5.3
What to do
Update WPLMS to 1.9.9.5.3 or newer.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024VibeBP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56041 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.5.1.
Product
VibeBP
What to do
Update VibeBP to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024VibeBP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56039 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.7.7.
Product
VibeBP
What to do
Update VibeBP to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Download Manager: Missing AuthorizationCVE-2024-56217 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.03.
Product
Download Manager
Affected
up to 3.3.03
What to do
Affects up to 3.3.03. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Userpro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56212 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9.
Product
Userpro
Affected
up to 5.1.9
What to do
Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2024Tracking Code Manager: Stored Cross-Site ScriptingCVE-2024-8721 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tracking Code Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tracking code field in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-10309 is a duplicate of this issue.
Product
Tracking Code Manager
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Tracking Code Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 20, 2024Download Manager: Does not sanitise and escape some of its settingsCVE-2024-10706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Download Manager
Fixed in
3.3.03
What to do
Update Download Manager to 3.3.03 or newer.
Full record and what to do →NVD record wpscan.com
Dec 19, 2024File Manager Pro – Filester: Unauthorized modification of dataCVE-2024-12331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_plugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Filebird plugin.
Product
File Manager Pro – Filester
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 19, 2024Download Manager: Unauthorized download of password-protected contentCVE-2024-11768 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.
Product
Download Manager
Affected
up to 3.3.03
What to do
Affects up to 3.3.03. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 19, 2024The Download Manager: Arbitrary shortcode executionCVE-2024-11740 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Download Manager
Affected
up to 3.3.03
What to do
Affects up to 3.3.03. Update The Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2024WP Project Manager: Sensitive Information ExposureCVE-2024-10548 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task List ('/wp-json/pm/v2/projects/1/task-lists') REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the hashed passwords of project owners (e.g. adminstrators).
Product
WP Project Manager
Affected
up to 2.6.15
What to do
Affects up to 2.6.15. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2024WPLMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56053 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
Product
WPLMS
Fixed in
1.9.9.5.3
What to do
Update WPLMS to 1.9.9.5.3 or newer.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024WPLMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56047 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
Product
WPLMS
Fixed in
1.9.9.5.3
What to do
Update WPLMS to 1.9.9.5.3 or newer.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Advance Menu Manager: Missing AuthorizationCVE-2024-54381 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Dotstore Advance Menu Manager advance-menu-manager.This issue affects Advance Menu Manager: from n/a through <= 3.1.1.
Product
Advance Menu Manager
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Advance Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024YDS Support Ticket System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55985 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ydesignservices YDS Support Ticket System yds-support-ticket-system allows SQL Injection.This issue affects YDS Support Ticket System: from n/a through <= 1.0.
Product
YDS Support Ticket System
Affected
up to 1.0
What to do
Affects up to 1.0. Update YDS Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Saksh Escrow System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55984 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susheelhbti Saksh Escrow System saksh-escrow-system allows SQL Injection.This issue affects Saksh Escrow System: from n/a through <= 2.4.
Product
Saksh Escrow System
Affected
up to 2.4
What to do
Affects up to 2.4. Update Saksh Escrow System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024PowerFormBuilder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55983 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PowerFormBuilder PowerFormBuilder power-forms-builder allows SQL Injection.This issue affects PowerFormBuilder: from n/a through <= 1.0.6.
Product
PowerFormBuilder
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update PowerFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Dr Affiliate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55975 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rohit Urane Dr Affiliate dr-affiliate allows SQL Injection.This issue affects Dr Affiliate: from n/a through <= 1.2.3.
Product
Dr Affiliate
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Dr Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 17, 2024Philantro – Donations and Donor Management: Stored Cross-Site ScriptingCVE-2024-12500 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Philantro – Donations and Donor Management
Affected
up to 5.2
What to do
Affects up to 5.2. Update Philantro – Donations and Donor Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS: Reflected Cross-Site ScriptingCVE-2024-12127 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 0.0.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS
Affected
up to 0.0.21
What to do
Affects up to 0.0.21. Update Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 16, 2024SeedProd Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54284 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10.
Product
SeedProd Pro
Affected
up to 6.18.10
What to do
Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024SeedProd Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54283 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10.
Product
SeedProd Pro
Affected
up to 6.18.10
What to do
Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024WPBookit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54280 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.
Product
WPBookit
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Job Board Manager: Missing AuthorizationCVE-2024-55993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.61.
Product
Job Board Manager
Affected
up to 2.1.61
What to do
Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Mollie for Contact Form 7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55990 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tsjippy Mollie for Contact Form 7 cf7-mollie allows Blind SQL Injection.This issue affects Mollie for Contact Form 7: from n/a through <= 5.0.0.
Product
Mollie for Contact Form 7
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Mollie for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024WP Simple Pay Lite Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55989 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kyle M Brown WP Simple Pay Lite Manager stripe-manager allows SQL Injection.This issue affects WP Simple Pay Lite Manager: from n/a through <= 1.4.
Product
WP Simple Pay Lite Manager
Affected
up to 1.4
What to do
Affects up to 1.4. Update WP Simple Pay Lite Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Navayan CSV Export: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55988 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export navayan-csv-export allows Blind SQL Injection.This issue affects Navayan CSV Export: from n/a through <= 1.0.9.
Product
Navayan CSV Export
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Navayan CSV Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Advanced What should we write next about: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55987 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows SQL Injection.This issue affects Advanced What should we write next about: from n/a through <= 1.0.3.
Product
Advanced What should we write next about
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Advanced What should we write next about to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Service: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55986 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tiny13 Service service allows Blind SQL Injection.This issue affects Service: from n/a through <= 1.0.4.
Product
Service
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Share Buttons – Social Media: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55982 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.
Product
Share Buttons – Social Media
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Share Buttons – Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Nabz Image Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55981 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.
Product
Nabz Image Gallery
Affected
up to 1.00
What to do
Affects up to 1.00. Update Nabz Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55980 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.
Product
Wr Age Verification
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55979 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.
Product
Wr Age Verification
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.