Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,813 results · page 36 of 57
Nov 4, 2024Woocommerce Quote Calculator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51626 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calculator-order allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through <= 1.1.
- Product
- Woocommerce Quote Calculator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Woocommerce Quote Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024BetterLinks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51672 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPDeveloper BetterLinks betterlinks allows SQL Injection.This issue affects BetterLinks: from n/a through <= 2.1.7.
- Product
- BetterLinks
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update BetterLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024Media LIbrary Assistant: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-51661 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.19.
- Product
- Media LIbrary Assistant
- Affected
- up to 3.19
- What to do
- Affects up to 3.19. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Send Emails with Mandrill: Missing AuthorizationCVE-2024-43208 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Matt Miller Send Emails with Mandrill send-emails-with-mandrill allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Send Emails with Mandrill: from n/a through <= 1.4.1.
- Product
- Send Emails with Mandrill
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Send Emails with Mandrill to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Advanced Cron Manager – debug & control: Missing AuthorizationCVE-2024-43154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9.
- Product
- Advanced Cron Manager – debug & control
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update Advanced Cron Manager – debug & control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Job Manager - Resume Manager: Missing AuthorizationCVE-2024-37443 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Automattic WP Job Manager - Resume Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.
- Product
- WP Job Manager - Resume Manager
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Job Manager - Resume Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024File Manager: Missing AuthorizationCVE-2024-37254 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mndpsingh287 File Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Manager: from n/a through 7.2.7.
- Product
- File Manager
- Affected
- up to 7.2.7
- What to do
- Affects up to 7.2.7. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024User Rights Access Manager: Access ControlCVE-2024-37209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Access Control vulnerability in Prism IT Systems User Rights Access Manager allows . This issue affects User Rights Access Manager: from n/a through 1.1.2.
- Product
- User Rights Access Manager
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update User Rights Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2024EKC Tournament Manager: Cross-Site Request Forgery (CSRF)CVE-2024-49674 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issue affects EKC Tournament Manager: from n/a through <= 2.2.1.
- Product
- EKC Tournament Manager
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update EKC Tournament Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Woo Manage Fraud Orders: Sensitive Information ExposureCVE-2024-10544 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files.
- Product
- Woo Manage Fraud Orders
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Woo Manage Fraud Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 30, 2024Download Manager: Doesn't sanitize some of it's shortcode parametersCVE-2024-8444 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.
- Product
- Download Manager
- Fixed in
- 3.3.00
- What to do
- Update Download Manager to 3.3.00 or newer.
Oct 29, 2024FileOrganizer – Manage WordPress and Website Files: Arbitrary file uploadsCVE-2024-7985 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the "fileorganizer_ajax_handler" function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: The FileOrganizer Pro plugin must be installed and active to allow Subscriber+ users to upload files.
- Product
- FileOrganizer – Manage WordPress and Website Files
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024BP Member Type Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49634 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimon Habib BP Member Type Manager bp-member-type-manager allows Reflected XSS.This issue affects BP Member Type Manager: from n/a through <= 1.01.
- Product
- BP Member Type Manager
- Affected
- up to 1.01
- What to do
- Affects up to 1.01. Update BP Member Type Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Ads.txt & App-ads.txt Manager for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50415 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Ads.txt & App-ads.txt Manager for WordPress app-ads-txt allows Stored XSS.This issue affects Ads.txt & App-ads.txt Manager for WordPress: from n/a through <= 1.1.7.1.
- Product
- Ads.txt & App-ads.txt Manager for
- Affected
- up to 1.1.7.1
- What to do
- Affects up to 1.1.7.1. Update Ads.txt & App-ads.txt Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024RSVP ME: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50491 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MicahBlu RSVP ME rsvp-me allows SQL Injection.This issue affects RSVP ME: from n/a through <= 1.9.9.
- Product
- RSVP ME
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update RSVP ME to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Woocommerce Quote Calculator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50479 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calculator-order allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through <= 1.1.
- Product
- Woocommerce Quote Calculator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Woocommerce Quote Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Premium SEO Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50465 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP SEO – Calin Vingan Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 1.6.001.
- Product
- Premium SEO Pack
- Affected
- up to 1.6.001
- What to do
- Affects up to 1.6.001. Update Premium SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2024School Management System – WPSchoolPress: Privilege escalationCVE-2024-9637 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.10. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with teacher-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- School Management System – WPSchoolPress
- Affected
- up to 2.2.10
- What to do
- Affects up to 2.2.10. Update School Management System – WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2024Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49691 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW woo-product-filter allows SQL Injection.This issue affects Product Filter by WBW: from n/a through <= 2.7.0.
- Product
- Product Filter by WBW
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2024WP Sessions Time Monitoring Full Automatic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49681 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows SQL Injection.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.0.9.
- Product
- WP Sessions Time Monitoring Full Automatic
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2024Transients Manager: Cross-Site Request ForgeryCVE-2024-10045 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the process_actions function. This makes it possible for unauthenticated attackers to delete transients via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Transients Manager
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Transients Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 21, 2024FunnelKit Automations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47328 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows SQL Injection.This issue affects FunnelKit Automations: from n/a through <= 3.1.2.
- Product
- FunnelKit Automations
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024VOD Infomaniak: Cross-Site Request Forgery (CSRF)CVE-2024-49274 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through <= 1.5.7.
- Product
- VOD Infomaniak
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024FERMA.ru.net: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49620 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mrcheck116 FERMA.ru.net ferma-ru-net-checkout allows Blind SQL Injection.This issue affects FERMA.ru.net: from n/a through <= 1.3.3.
- Product
- FERMA.ru.net
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update FERMA.ru.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Social Link Groups: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49619 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acespritech Social Link Groups social-link-groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through <= 1.1.0.
- Product
- Social Link Groups
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Social Link Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024MyTweetLinks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49618 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordan Lyall MyTweetLinks mytweetlinks allows Blind SQL Injection.This issue affects MyTweetLinks: from n/a through <= 1.1.1.
- Product
- MyTweetLinks
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update MyTweetLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Rate Own Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49616 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in nyasro Rate Own Post rate-own-post allows Blind SQL Injection.This issue affects Rate Own Post: from n/a through <= 1.0.
- Product
- Rate Own Post
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Rate Own Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024SermonAudio Widgets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49614 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SermonAudio SermonAudio Widgets sermonaudio-widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through <= 1.9.3.
- Product
- SermonAudio Widgets
- Affected
- up to 1.9.3
- What to do
- Affects up to 1.9.3. Update SermonAudio Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Simple Code Insert Shortcode: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49613 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in developersnote Simple Code Insert Shortcode simple-code-insert-shortcode allows SQL Injection.This issue affects Simple Code Insert Shortcode: from n/a through <= 1.0.
- Product
- Simple Code Insert Shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple Code Insert Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024SW Contact Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49612 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanjeev SW Contact Form sw-contact-form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through <= 1.0.
- Product
- SW Contact Form
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update SW Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Author Discussion: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49609 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion author-discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through <= 0.2.2.
- Product
- Author Discussion
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update Author Discussion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024MPG: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47325 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects MPG: from n/a through <= 3.4.7.
- Product
- MPG
- Affected
- up to 3.4.7
- What to do
- Affects up to 3.4.7. Update MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024EU/UK VAT Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44061 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EU/UK VAT Manager for WooCommerce eu-vat-for-woocommerce.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through <= 2.12.14.
- Product
- EU/UK VAT Manager for WooCommerce
- Affected
- up to 2.12.14
- What to do
- Affects up to 2.12.14. Update EU/UK VAT Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Duplicate Title Validate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49623 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hasan movahed Duplicate Title Validate duplicate-title-validate allows Blind SQL Injection.This issue affects Duplicate Title Validate: from n/a through <= 1.0.
- Product
- Duplicate Title Validate
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Duplicate Title Validate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Property Lot Management System: Unrestricted Upload of File with Dangerous TypeCVE-2024-49331 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System plms allows Upload a Web Shell to a Web Server.This issue affects Property Lot Management System: from n/a through <= 4.2.38.
- Product
- Property Lot Management System
- Affected
- up to 4.2.38
- What to do
- Affects up to 4.2.38. Update Property Lot Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Sovratec Case Management: Unrestricted Upload of File with Dangerous TypeCVE-2024-49324 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in sovratecdev Sovratec Case Management sovratec-case-management allows Upload a Web Shell to a Web Server.This issue affects Sovratec Case Management: from n/a through <= 1.0.0.
- Product
- Sovratec Case Management
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Sovratec Case Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Shipyaari Shipping Management: Deserialization of Untrusted DataCVE-2024-49626 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Piyush Patel Shipyaari Shipping Management shipyaari-shipping-managment allows Object Injection.This issue affects Shipyaari Shipping Management: from n/a through <= 1.2.
- Product
- Shipyaari Shipping Management
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Shipyaari Shipping Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024MAS Companies For WP Job Manager: Reflected Cross-Site ScriptingCVE-2024-9206 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- MAS Companies For WP Job Manager
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update MAS Companies For WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 18, 2024Easy Menu Manager | WPZest: Stored Cross-Site ScriptingCVE-2024-9366 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Easy Menu Manager | WPZest
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Easy Menu Manager | WPZest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 17, 2024Click to Chat – WP Support All-in-One Floating Widget: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-49281 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through <= 2.3.3.
- Product
- Click to Chat – WP Support All-in-One Floating Widget
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Click to Chat – WP Support All-in-One Floating Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Admin Management Xtended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49307 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Stored XSS.This issue affects Admin Management Xtended : from n/a through <= 2.4.6.
- Product
- Admin Management Xtended
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Admin Management Xtended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Job Board Manager for: Incorrect Privilege AssignmentCVE-2024-49322 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress jemployee allows Privilege Escalation.This issue affects Job Board Manager for WordPress: from n/a through <= 1.0.
- Product
- Job Board Manager for
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Job Board Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Email Verification for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49305 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Email Verification for WooCommerce emails-verification-for-woocommerce allows SQL Injection.This issue affects Email Verification for WooCommerce: from n/a through <= 2.8.10.
- Product
- Email Verification for WooCommerce
- Affected
- up to 2.8.10
- What to do
- Affects up to 2.8.10. Update Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Surfer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49299 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Surfer Surfer surferseo allows SQL Injection.This issue affects Surfer: from n/a through <= 1.5.0.502.
- Product
- Surfer
- Affected
- up to 1.5.0.502
- What to do
- Affects up to 1.5.0.502. Update Surfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Zoho CRM Lead Magnet: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49297 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows SQL Injection.This issue affects Zoho CRM Lead Magnet: from n/a through <= 1.7.9.7.
- Product
- Zoho CRM Lead Magnet
- Affected
- up to 1.7.9.7
- What to do
- Affects up to 1.7.9.7. Update Zoho CRM Lead Magnet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Ajax Rating with Custom Login: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49246 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anand23 Ajax Rating with Custom Login ajax-rating-with-custom-login allows SQL Injection.This issue affects Ajax Rating with Custom Login: from n/a through <= 1.1.
- Product
- Ajax Rating with Custom Login
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Ajax Rating with Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024CSV Product Import Export for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49244 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vrinsoft CSV Product Import Export for WooCommerce csv-wc-product-import-export.This issue affects CSV Product Import Export for WooCommerce: from n/a through <= 1.0.0.
- Product
- CSV Product Import Export for WooCommerce
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update CSV Product Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Classic Editor and Classic Widgets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47312 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Grim Classic Editor and Classic Widgets classic-editor-and-classic-widgets allows SQL Injection.This issue affects Classic Editor and Classic Widgets: from n/a through <= 1.4.1.
- Product
- Classic Editor and Classic Widgets
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Classic Editor and Classic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Fluent Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47304 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Fluent Support fluent-support allows SQL Injection.This issue affects Fluent Support: from n/a through <= 1.8.0.
- Product
- Fluent Support
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Fluent Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024FREE DOWNLOAD MANAGER: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49315 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through <= 1.0.0.
- Product
- FREE DOWNLOAD MANAGER
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update FREE DOWNLOAD MANAGER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.