Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,491 results · page 37 of 50

Jul 9, 2024XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ: Unauthorized modification of dataCVE-2024-5704 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e. ffw_insert_new_faq, ffw_hide_discount_notice, ffw_delete_all_faqs, ffw_delete_single_faq, etc...) in all versions up to, and including, 1.7.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to add new and update existing FAQs, FAQ lists, and modify FAQ associations with products.
Product
XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin]: Unauthorized modification of dataCVE-2024-5669 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ffw_activate_template' function in all versions up to, and including, 1.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store cross-site scripting that will trigger when viewing the dashboard templates or accessing FAQs.
Product
XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin]
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024LearnDash LMS – Reports: Unauthorized modification of dataCVE-2024-5648 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e. wrld_set_configuration, wrld_exclude_settings_save, apply_time_tracking_settings, wp_ajax_wrld_gutenberg_block_visit, etc..) in all versions up to, and including, 1.8.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update various plugin settings.
Product
LearnDash LMS – Reports
Affected
up to 1.8.2.1
What to do
Affects up to 1.8.2.1. Update LearnDash LMS – Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Pricing Table: Unauthorized access of dataCVE-2024-4102 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Pricing Table plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions like editing pricing tables.
Product
Pricing Table
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Product Designer: Unauthorized loss of dataCVE-2024-3608 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue.
Product
Product Designer
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024WooCommerce Social Login: Deserialization of Untrusted DataCVE-2024-37502 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login woo-social-login.This issue affects WooCommerce Social Login: from n/a through <= 2.6.3.
Product
WooCommerce Social Login
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update WooCommerce Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024EventON: Unauthorized modification of dataCVE-2024-6180 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventon_import_settings' ajax action in all versions up to, and including, 2.2.15. This makes it possible for unauthenticated attackers to update plugin settings, including adding stored cross-site scripting to settings options displayed on event calendar pages.
Product
EventON
Affected
up to 2.2.15
What to do
Affects up to 2.2.15. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 8, 2024Media Hygiene: Remove or Delete Unused Images and More!: Unauthorized loss of dataCVE-2024-5855 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the bulk_action_delete and delete_single_image_call AJAX actions in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments. A nonce check was added in version 3.0.1, however, it wasn't until version 3.0.2 that a capability check was added.
Product
Media Hygiene: Remove or Delete Unused Images and More!
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Media Hygiene: Remove or Delete Unused Images and More! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 4, 2024One Click Order Re-Order: Unauthorized modification of dataCVE-2024-5641 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ced_ocor_save_general_setting' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the plugin settings, including adding stored cross-site scripting.
Product
One Click Order Re-Order
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update One Click Order Re-Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Post Meta Data Manager: Stored Cross-Site ScriptingCVE-2024-6264 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Meta Data Manager
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Cost Calculator Builder: Unauthorized modification of dataCVE-2024-6012 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary posts and append arbitrary content to existing posts.
Product
Cost Calculator Builder
Affected
up to 3.2.12
What to do
Affects up to 3.2.12. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2024-5260 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘read_more_text’ parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Motors – Car Dealer, Classifieds & Listing: Unauthorized modification of dataCVE-2024-5545 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stm_edit_delete_user_car function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpublish arbitrary posts and pages.
Product
Motors – Car Dealer, Classifieds & Listing
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2024Quiz and Survey Master (QSM): Is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX actionCVE-2024-5606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
Product
Quiz and Survey Master (QSM)
Fixed in
9.0.2
What to do
Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 28, 2024Easy Affiliate Links: Unauthorized modification of dataCVE-2024-5864 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eafl_reset_settings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
Product
Easy Affiliate Links
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update Easy Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 28, 2024Easy Image Collage: Unauthorized loss of dataCVE-2024-5863 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Easy Image Collage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_image_collage() function in all versions up to, and including, 1.13.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to erase all of the content in arbitrary posts.
Product
Easy Image Collage
Affected
up to 1.13.5
What to do
Affects up to 1.13.5. Update Easy Image Collage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 27, 2024kadence-blocks-pro: Does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the databaseCVE-2024-1330 · WordPress plugins & themes · reported by WPScanMedium 4.3
The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database.
Product
kadence-blocks-pro
Fixed in
2.3.8
What to do
Update kadence-blocks-pro to 2.3.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 25, 2024Zita Elementor Site Library: Unauthorized modification of dataCVE-2024-3249 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_xml_data, xml_data_import, import_option_data, import_widgets, and import_customizer_settings functions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages, update certain options, including WooCommerce page titles and Elementor settings, import widgets, and update the plugin's customizer settings and the WordPress custom CSS. NOTE: This vulnerability was partially fixed in version 1.6.2.
Product
Zita Elementor Site Library
Affected
up to 1.6.2
Fixed in
1.6.2
What to do
Update Zita Elementor Site Library to 1.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024Sparkle Demo Importer: Unauthorized database reset and demo data importCVE-2024-6120 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multiple functions in all versions up to and including 1.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all posts, pages, and uploaded files, as well as download and install a limited set of demo plugins.
Product
Sparkle Demo Importer
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Sparkle Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024WP Logs Book: Does not sanitise and escape some of its log data before outputting them back in an admin dashboardCVE-2024-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting
Product
WP Logs Book
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages: Unauthorized modification of dataCVE-2024-3961 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tag_subscriber function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to subscribe users to tags. Financial damages may occur to site owners if their API quota is exceeded.
Product
ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 20, 2024WP Child Theme Generator: Unauthorized modification of dataCVE-2024-3610 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_theme() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child theme and activate it cause the site to whitescreen.
Product
WP Child Theme Generator
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Child Theme Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024Hide Dashboard Notifications: Unauthorized modification of dataCVE-2024-1955 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_notices_settings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's settings.
Product
Hide Dashboard Notifications
Affected
up to 1.3
What to do
Affects up to 1.3. Update Hide Dashboard Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024License Manager for WooCommerce: Unauthorized access of dataCVE-2024-1639 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.6. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the "license" JS variable. Please note that the version in trunk is patched, however, the 3.0.7 tagged version is not.
Product
License Manager for WooCommerce
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update License Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2024-5036 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Wheel of Life: Coaching and Assessment Tool for Life Coach: Unauthorized modification and loss of dataCVE-2024-3627 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts and modify settings.
Product
Wheel of Life: Coaching and Assessment Tool for Life Coach
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Wheel of Life: Coaching and Assessment Tool for Life Coach to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Page Builder: Live Composer: Deserialization of Untrusted DataCVE-2024-35780 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.42.
Product
Page Builder: Live Composer
Affected
up to 1.5.42
What to do
Affects up to 1.5.42. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024MIMO Woocommerce Order Tracking: Unauthorized modification of dataCVE-2024-5768 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimo_update_provider' function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update shipping provider information, including adding stored cross-site scripting.
Product
MIMO Woocommerce Order Tracking
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update MIMO Woocommerce Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 18, 2024Tickera – WordPress Event Ticketing: Unauthorized loss of dataCVE-2024-5860 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_tickets AJAX action in all versions up to, and including, 3.5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all tickets associated with events.
Product
Tickera – WordPress Event Ticketing
Affected
up to 3.5.2.8
What to do
Affects up to 3.5.2.8. Update Tickera – WordPress Event Ticketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 17, 2024Ibtana – WordPress Website Builder: Unauthorized modification of dataCVE-2024-5541 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana_visual_editor_register_ajax_json_endpont' function in all versions up to, and including, 1.2.3.3. This makes it possible for unauthenticated attackers to update option values for reCAPTCHA keys on the WordPress site. This can be leveraged to bypass reCAPTCHA on the site. CVE-2024-37123 is likely a duplicate of this issue.
Product
Ibtana – WordPress Website Builder
Affected
up to 1.2.3.3
What to do
Affects up to 1.2.3.3. Update Ibtana – WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2024Scheduling Plugin – Online Booking for: Unauthorized loss of dataCVE-2024-1634 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsb_disconnect_settings' function in all versions up to, and including, 3.5.10. This makes it possible for unauthenticated attackers to disconnect the plugin from the startbooking service and remove connection data.
Product
Scheduling Plugin – Online Booking for
Affected
up to 3.5.10
What to do
Affects up to 3.5.10. Update Scheduling Plugin – Online Booking for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 15, 2024AI Infographic Maker: Unauthorized modification of dataCVE-2024-5858 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_generate_desc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post titles.
Product
AI Infographic Maker
Affected
up to 4.7.4
What to do
Affects up to 4.7.4. Update AI Infographic Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024Popup Builder: Unauthorized modification of data and loss of dataCVE-2024-2544 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorized actions, such as deleting subscribers, and importing subscribers to conduct stored cross-site scripting attacks.
Product
Popup Builder
Fixed in
4.3.2
What to do
Update Popup Builder to 4.3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2024LatePoint: Unauthorized access of data and modification of dataCVE-2024-2472 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.
Product
LatePoint
Affected
up to 4.9.9
What to do
Affects up to 4.9.9. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record aramhairchitects.nl websec.nl
Jun 14, 2024Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling: Unauthorized modification of dataCVE-2024-1094 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. CVE-2024-37427 is likely a duplicate of this issue.
Product
Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Affected
up to 1.0.21
What to do
Affects up to 1.0.21. Update Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2024Schema App Structured Data: Cross-Site Request ForgeryCVE-2024-0892 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schema App Structured Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the MarkUpdate function. This makes it possible for unauthenticated attackers to update and delete post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Schema App Structured Data
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2024Download Manager: Unauthorized access of dataCVE-2024-2098 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' function in all versions up to, and including, 3.2.89. This makes it possible for unauthenticated attackers to download password-protected files.
Product
Download Manager
Affected
up to 3.2.89
What to do
Affects up to 3.2.89. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 11, 2024Advanced Contact form 7 DB: Unauthorized access of dataCVE-2024-4319 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to download the entry data for submitted forms.
Product
Advanced Contact form 7 DB
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Advanced Contact form 7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2024Database Cleaner: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35712 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.This issue affects Database Cleaner: from n/a through 1.0.5.
Product
Database Cleaner
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Missing AuthorizationCVE-2024-32818 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024CF7 Google Sheets Connector: Unauthorized modification of dataCVE-2024-5654 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unauthenticated attackers to toggle site configuration settings, including WP_DEBUG, WP_DEBUG_LOG, SCRIPT_DEBUG, and SAVEQUERIES.
Product
CF7 Google Sheets Connector
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update CF7 Google Sheets Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 8, 2024Salon booking system: Unauthorized access and modification of dataCVE-2024-4468 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with subscriber access or higher to modify plugin settings and view discount codes intended for other users.
Product
Salon booking system
Affected
up to 9.9
What to do
Affects up to 9.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 8, 2024Minimal Coming Soon – Coming Soon Page: Unauthorized modification of dataCVE-2024-5087 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could disable features of the plugin.
Product
Minimal Coming Soon – Coming Soon Page
Affected
up to 2.38
What to do
Affects up to 2.38. Update Minimal Coming Soon – Coming Soon Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 8, 2024WP Reset: Unauthorized modification of dataCVE-2024-4661 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all versions up to, and including, 2.02. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the value fo the 'License Key' field for the 'Activate Pro License' setting.
Product
WP Reset
Affected
up to 2.02
What to do
Affects up to 2.02. Update WP Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 8, 2024WP Force SSL & HTTPS SSL Redirect: Unauthorized modification of dataCVE-2024-5770 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.
Product
WP Force SSL & HTTPS SSL Redirect
Affected
up to 1.66
What to do
Affects up to 1.66. Update WP Force SSL & HTTPS SSL Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Unauthorized modification of dataCVE-2024-5382 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.
Product
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Affected
up to 2.0.6.1
What to do
Affects up to 2.0.6.1. Update Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 7, 2024Market Exporter: Unauthorized loss of dataCVE-2024-5637 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use path traversal to delete arbitrary files on the server.
Product
Market Exporter
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024Strong Testimonials: Unauthorized modification of dataCVE-2023-6491 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views.
Product
Strong Testimonials
Affected
up to 3.1.12
What to do
Affects up to 3.1.12. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2024GDPR CCPA Compliance & Cookie Consent Banner: Unauthorized modification of dataCVE-2024-5607 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings() in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings, update page content, send arbitrary emails and inject malicious web scripts.
Product
GDPR CCPA Compliance & Cookie Consent Banner
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update GDPR CCPA Compliance & Cookie Consent Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2024WooCommerce Tools: Unauthorized modification of dataCVE-2024-1689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_module() function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to deactivate arbitrary plugin modules.
Product
WooCommerce Tools
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WooCommerce Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.