Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

2,856 results · page 36 of 58

Jun 11, 2024WooCommerce Canada Post Shipping: Missing AuthorizationCVE-2023-51498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3.
Product
WooCommerce Canada Post Shipping
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update WooCommerce Canada Post Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor: Sensitive Information ExposureCVE-2024-4266 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.
Product
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2024Blog2Social: Social Media Auto Post & Scheduler: SQL InjectionCVE-2024-3549 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 7.4.1
What to do
Affects up to 7.4.1. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 11, 2024Advanced Contact form 7 DB: Sensitive Information ExposureCVE-2024-3723 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
Product
Advanced Contact form 7 DB
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Advanced Contact form 7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 10, 2024Custom Field Template: Sensitive Information ExposureCVE-2023-6748 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata.
Product
Custom Field Template
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2024AI Post Generator | AutoWriter: Missing AuthorizationCVE-2024-32713 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AutoWriter AI Post Generator | AutoWriter.This issue affects AI Post Generator | AutoWriter: from n/a through 3.3.
Product
AI Post Generator | AutoWriter
Affected
up to 3.3
What to do
Affects up to 3.3. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Evergreen Content Poster: Missing AuthorizationCVE-2024-32824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster.This issue affects Evergreen Content Poster: from n/a through <= 1.4.2.
Product
Evergreen Content Poster
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Evergreen Content Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024PostX: Missing AuthorizationCVE-2024-31246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 3.2.3.
Product
PostX
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Widget Options - Extended: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35691 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - Extended: from n/a through 5.1.0.
Product
Widget Options - Extended
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Widget Options - Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Otter Blocks PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35682 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11.
Product
Otter Blocks PRO
Affected
up to 2.6.11
What to do
Affects up to 2.6.11. Update Otter Blocks PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Podlove Web Player: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35710 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through 5.7.3.
Product
Podlove Web Player
Affected
up to 5.7.3
What to do
Affects up to 5.7.3. Update Podlove Web Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024The Post Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35739 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.1.
Product
The Post Grid
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 7, 2024FileOrganizer – Manage WordPress and Website Files: Sensitive Information ExposureCVE-2024-5599 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
Product
FileOrganizer – Manage WordPress and Website Files
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks: Stored Cross-Site ScriptingCVE-2024-4042 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the menu-wrap-item block in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Affected
up to 2.2.80
What to do
Affects up to 2.2.80. Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 7, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks: Stored Cross-Site ScriptingCVE-2024-1988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute in blocks in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Affected
up to 2.2.80
What to do
Affects up to 2.2.80. Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2024Open Graph: Sensitive Information ExposureCVE-2024-5615 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'opengraph_default_description' function. This makes it possible for unauthenticated attackers to extract sensitive data including partial content of password-protected blog posts.
Product
Open Graph
Affected
up to 1.11.2
What to do
Affects up to 1.11.2. Update Open Graph to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024BuddyPress Members Only: Sensitive Information ExposureCVE-2024-0972 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "All Other Sections On Your Site Will be Opened to Guest" feature (when unset) and view restricted page and post content.
Product
BuddyPress Members Only
Affected
up to 3.4.9
What to do
Affects up to 3.4.9. Update BuddyPress Members Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024Restrict for Elementor: Sensitive Information ExposureCVE-2024-0910 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract potentially sensitive data from post content.
Product
Restrict for Elementor
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Restrict for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 5, 2024The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the requestCVE-2024-4886 · WordPress plugins & themes · reported by WPScanMedium 4.3
The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request
Fixed in
2.6.00
What to do
Update the plugin to 2.6.00 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024LearnPress – WordPress LMS: Sensitive Information ExposureCVE-2024-5483 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of get_items_permissions_check function. This makes it possible for unauthenticated attackers to extract basic information about website users, including their emails
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.8
What to do
Affects up to 4.2.6.8. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 4, 2024Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35653 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through <= 45.8.0.
Product
Visual Composer Website Builder
Affected
up to 45.8.0
What to do
Affects up to 45.8.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024All In One WP Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52147 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4.
Product
All In One WP Security & Firewall
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update All In One WP Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Rate my Post – WP Rating System: Authentication Bypass by SpoofingCVE-2023-51667 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.2.
Product
Rate my Post – WP Rating System
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update Rate my Post – WP Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Ultimate Dashboard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49822 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Vongries Ultimate Dashboard allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ultimate Dashboard: from n/a through 3.7.10.
Product
Ultimate Dashboard
Affected
up to 3.7.10
What to do
Affects up to 3.7.10. Update Ultimate Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Photo Album Plus: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49774 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
Product
WP Photo Album Plus
Affected
up to 8.5.02.005
What to do
Affects up to 8.5.02.005. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WPS Hide Login: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49748 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPServeur, NicolasKulka, wpformation WPS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPS Hide Login: from n/a through 1.9.11.
Product
WPS Hide Login
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Hide login page: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48335 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Webcraftic Hide login page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hide login page: from n/a through 1.1.9.
Product
Hide login page
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Hide login page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024LWS Hide Login: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47818 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in LWS LWS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LWS Hide Login: from n/a through 2.1.8.
Product
LWS Hide Login
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update LWS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP-PostRatings: Improper Control of Interaction FrequencyCVE-2023-40332 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.
Product
WP-PostRatings
Affected
up to 1.91
What to do
Affects up to 1.91. Update WP-PostRatings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WPUpper Share Buttons: Unauthorized access of data when preparing sharing links for posts and pagesCVE-2024-4997 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPUpper Share Buttons plugin for WordPress is vulnerable to unauthorized access of data when preparing sharing links for posts and pages in all versions up to, and including, 3.43. This makes it possible for unauthenticated attackers to obtain the contents of password protected posts and pages.
Product
WPUpper Share Buttons
Affected
up to 3.43
What to do
Affects up to 3.43. Update WPUpper Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 4, 2024The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included inCVE-2024-4750 · WordPress plugins & themes · reported by WPScanMedium 5.3
The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included in the request
Product
buddyboss-platform
Fixed in
2.6.0
What to do
Update buddyboss-platform to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024Gutenberg Blocks with AI by Kadence WP: Does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embedCVE-2024-4057 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenberg Blocks with AI by Kadence WP
Fixed in
3.2.37
What to do
Update Gutenberg Blocks with AI by Kadence WP to 3.2.37 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024tagDiv Composer: Stored Cross-Site ScriptingCVE-2024-3888 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button shortcode in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: The vulnerable code in this plugin is specifically tied to the tagDiv Newspaper theme. If another theme is installed (e.g., NewsMag), this code may not be present.
Product
tagDiv Composer
Affected
up to 4.8
What to do
Affects up to 4.8. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Jun 3, 2024WP Next Post Navi: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34793 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kharim Tomlinson WP Next Post Navi allows Stored XSS.This issue affects WP Next Post Navi: from n/a through 1.8.3.
Product
WP Next Post Navi
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update WP Next Post Navi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Post Grid Elementor Addon: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34789 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Hait Post Grid Elementor Addon allows Stored XSS.This issue affects Post Grid Elementor Addon: from n/a through 2.0.16.
Product
Post Grid Elementor Addon
Affected
up to 2.0.16
What to do
Affects up to 2.0.16. Update Post Grid Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Contact Form Widget: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34754 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Contact Form Widget.This issue affects Contact Form Widget: from n/a through 1.3.9.
Product
Contact Form Widget
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Contact Form Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 1, 2024Content Blocks (Custom Post Widget): Stored Cross-Site ScriptingCVE-2024-3565 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_block' shortcode in all versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Content Blocks (Custom Post Widget)
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Content Blocks (Custom Post Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 1, 2024Content Blocks (Custom Post Widget): Local File InclusionCVE-2024-3564 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's 'content_block' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Content Blocks (Custom Post Widget)
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Content Blocks (Custom Post Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 31, 2024Auto Featured Image (Auto Post Thumbnail): Server-Side Request ForgeryCVE-2023-7073 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library AJAX action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Auto Featured Image (Auto Post Thumbnail)
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 30, 2024Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX: Unauthorized modification of dataCVE-2024-5326 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postx_presets_callback' function in all versions up to, and including, 4.1.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Product
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2024POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications: Time-based SQL InjectionCVE-2024-5207 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator access or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2024Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX: Stored Cross-Site ScriptingCVE-2024-5223 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploading feature in all versions up to, and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 24, 2024Event post: Unauthorized bulk metadata updateCVE-2024-1376 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. This makes it possible for authenticated attackers, with subscriber access or higher, to update post_meta_data.
Product
Event post
Affected
up to 5.9.4
What to do
Affects up to 5.9.4. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2024WP Ultimate Post Grid: Stored Cross-Site ScriptingCVE-2024-4043 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpupg-text' shortcode in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Ultimate Post Grid
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update WP Ultimate Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024NextScripts: Social Networks Auto-Poster: Sensitive Information ExposureCVE-2024-2088 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.3 via the 'nxs_getExpSettings' function. This makes it possible for authenticated attackers, with subscriber access and above, to extract sensitive data including social network API keys and secrets.
Product
NextScripts: Social Networks Auto-Poster
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update NextScripts: Social Networks Auto-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024NextScripts: Social Networks Auto-Poster: Stored Cross-Site ScriptingCVE-2024-1762 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP_USER_AGENT header in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the victim to select view "All Cron Events" in order for the injection to fire.
Product
NextScripts: Social Networks Auto-Poster
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update NextScripts: Social Networks Auto-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024NextScripts: Social Networks Auto-Poster: Cross-Site Request ForgeryCVE-2024-1446 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.3. This is due to missing or incorrect nonce validation on the nxssnap-reposter page. This makes it possible for unauthenticated attackers to delete arbitrary posts or pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
NextScripts: Social Networks Auto-Poster
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update NextScripts: Social Networks Auto-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 20, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks: Stored Cross-Site ScriptingCVE-2024-3155 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Affected
up to 2.2.80
What to do
Affects up to 2.2.80. Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 20, 2024All in One SEO: Does not validate and escape some of its Post fields before outputting them backCVE-2024-3368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
All in One SEO
Fixed in
4.6.1.1
What to do
Update All in One SEO to 4.6.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2024WTI Like Post: Authentication Bypass by SpoofingCVE-2024-33917 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in webtechideas WTI Like Post allows Functionality Bypass.This issue affects WTI Like Post: from n/a through 1.4.6.
Product
WTI Like Post
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update WTI Like Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.