Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

2,856 results · page 37 of 58

May 17, 2024Download Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32131 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82.
Product
Download Manager
Affected
up to 3.2.82
What to do
Affects up to 3.2.82. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2024Bulk Posts Editing For: Cross-Site Request ForgeryCVE-2024-4204 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to missing or incorrect nonce validation on the plugin's AJAX actions.. This makes it possible for unauthenticated attackers to create and duplicate posts, retrieve post content, and modify post taxonomy among other things via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Bulk Posts Editing For
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update Bulk Posts Editing For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 16, 2024Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plguin: Stored Cross-Site ScriptingCVE-2024-4400 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plguin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 1.26.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plguin
Affected
up to 1.26.4
What to do
Affects up to 1.26.4. Update Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plguin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 16, 2024Custom Post Type Attachment: Stored Cross-Site ScriptingCVE-2024-4546 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Post Type Attachment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pdf_attachment' shortcode in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Custom Post Type Attachment
Affected
up to 3.4.5
What to do
Affects up to 3.4.5. Update Custom Post Type Attachment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Bulk Posts Editing For: Unauthorized access of functionalityCVE-2024-4199 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to invoke their corresponding functions. This may lead to post creation and duplication, post content retrieval, post taxonomy manipulation.
Product
Bulk Posts Editing For
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update Bulk Posts Editing For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Visual Portfolio, Photo Gallery & Post Grid: Stored Cross-Site ScriptingCVE-2024-4363 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Portfolio, Photo Gallery & Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visual Portfolio, Photo Gallery & Post Grid
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Visual Portfolio, Photo Gallery & Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 14, 2024Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease: Sensitive Information ExposureCVE-2024-0437 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the API. This makes it possible for authenticated attackers, with subscriber access or higher, to extract post titles and content, thus bypassing the plugin's password protection.
Product
Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3241 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Ultimate Blocks
Fixed in
3.1.7
What to do
Update Ultimate Blocks to 3.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode): Stored Cross-Site ScriptingCVE-2024-4446 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagingType’ parameter in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode)
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Shopping Cart & eCommerce Store: Sensitive Information ExposureCVE-2024-4213 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.4 via the order report functionality. This makes it possible for unauthenticated attackers to extract sensitive data including order details such as payment details, addresses and other PII.
Product
Shopping Cart & eCommerce Store
Affected
up to 5.6.4
What to do
Affects up to 5.6.4. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Post Grid Gutenberg Blocks and WordPress Blog
Fixed in
4.0.2
What to do
Update Post Grid Gutenberg Blocks and WordPress Blog to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Last Viewed Posts by WPBeginner: PHP Object InjectionCVE-2024-3070 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input from the LastViewedPosts Cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Last Viewed Posts by WPBeginner
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Last Viewed Posts by WPBeginner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Academy LMS: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35171 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a through 1.9.25.
Product
Academy LMS
Affected
up to 1.9.25
What to do
Affects up to 1.9.25. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Filebird: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35166 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3.
Product
Filebird
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update Filebird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Gutenify: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35165 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gutenify.This issue affects Gutenify: from n/a through 1.4.0.
Product
Gutenify
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Gutenify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP Job Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34549 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.2.2.
Product
WP Job Manager
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024TT Custom Post Type Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34430 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rashed Latif TT Custom Post Type Creator allows Stored XSS.This issue affects TT Custom Post Type Creator: from n/a through 1.0.
Product
TT Custom Post Type Creator
Affected
up to 1.0
What to do
Affects up to 1.0. Update TT Custom Post Type Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WP Favorite Posts: Cross-Site Request Forgery (CSRF)CVE-2024-34427 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Favorite Posts.This issue affects WP Favorite Posts: from n/a through 1.6.8.
Product
WP Favorite Posts
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update WP Favorite Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Easy Digital Downloads: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32100 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11.
Product
Easy Digital Downloads
Affected
up to 3.2.11
What to do
Affects up to 3.2.11. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Vitepos: Missing AuthorizationCVE-2024-33574 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1.
Product
Vitepos
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Content Blocks (Custom Post Widget): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34566 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a through 3.3.0.
Product
Content Blocks (Custom Post Widget)
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Content Blocks (Custom Post Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024WP Latest Posts: Arbitrary shortcode executionCVE-2024-4135 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin allowing users to execute an action that does not properly validate a user-supplied value prior to using that value in a call to do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
WP Latest Posts
Affected
up to 5.0.7
What to do
Affects up to 5.0.7. Update WP Latest Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2024Post Grid Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34390 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue affects Post Grid Master: from n/a through 3.4.8.
Product
Post Grid Master
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024WP Post Author: Missing AuthorizationCVE-2024-34389 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
Product
WP Post Author
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024WP Post Author: Missing AuthorizationCVE-2024-34387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
Product
WP Post Author
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update WP Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Post Grid Master: Missing AuthorizationCVE-2024-34372 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7.
Product
Post Grid Master
Affected
up to 3.4.7
What to do
Affects up to 3.4.7. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Mooberry Book Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mooberry Dreams Mooberry Book Manager.This issue affects Mooberry Book Manager: from n/a through 4.15.12.
Product
Mooberry Book Manager
Affected
up to 4.15.12
What to do
Affects up to 4.15.12. Update Mooberry Book Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024GDPR Compliance: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34388 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5.
Product
GDPR Compliance
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update GDPR Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 6, 2024Robo Gallery: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34382 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18.
Product
Robo Gallery
Affected
up to 3.2.18
What to do
Affects up to 3.2.18. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Carousel Slider: Does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embedCVE-2024-3703 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
Product
Carousel Slider
Fixed in
2.2.10
What to do
Update Carousel Slider to 2.2.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 3, 2024Gutenverse: Does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embedCVE-2024-3692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenverse
Fixed in
1.9.1
What to do
Update Gutenverse to 1.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2024The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid: Unauthorized modification of dataCVE-2024-3936 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtTPGSaveSettings function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with subscriber access or higher, to change the plugin's settings and invoke other functions hooked by AJAX actions.
Product
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Contact Form 7 Database Addon – CFDB7: Sensitive Information ExposureCVE-2024-3870 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Contact Form 7 Database Addon – CFDB7 plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6.8 via the cfdb7_before_send_mail function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.
Product
Contact Form 7 Database Addon – CFDB7
Affected
up to 1.2.6.8
What to do
Affects up to 1.2.6.8. Update Contact Form 7 Database Addon – CFDB7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Drag and Drop Multiple File Upload – Contact Form 7: Sensitive Information ExposureCVE-2024-3717 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wp_dndcf7_uploads/wpcf7-files' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form.
Product
Drag and Drop Multiple File Upload – Contact Form 7
Affected
up to 1.3.7.7
What to do
Affects up to 1.3.7.7. Update Drag and Drop Multiple File Upload – Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Easy Custom Auto Excerpt: Sensitive Information ExposureCVE-2024-3312 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Custom Auto Excerpt plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12. This makes it possible for unauthenticated attackers to obtain excerpts of password-protected posts.
Product
Easy Custom Auto Excerpt
Affected
up to 2.4.12
What to do
Affects up to 2.4.12. Update Easy Custom Auto Excerpt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024eRoom – Zoom Meetings & Webinars: Sensitive Information ExposureCVE-2024-3275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.18 via the search_posts function. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain post excerpts including those of draft and pending posts.
Product
eRoom – Zoom Meetings & Webinars
Affected
up to 1.4.18
What to do
Affects up to 1.4.18. Update eRoom – Zoom Meetings & Webinars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Mhr Post Ticker: Stored Cross-Site ScriptingCVE-2024-3021 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Mhr Post Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Header Title value in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Mhr Post Ticker
Affected
up to 1.1
What to do
Affects up to 1.1. Update Mhr Post Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor: Stored Cross-Site ScriptingCVE-2024-2967 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 2, 2024Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.: Blind SQL InjectionCVE-2024-2661 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. plugin for WordPress is vulnerable to blind SQL Injection via the ‘currentIds’ parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Booster Extension: Sensitive Information ExposureCVE-2024-2109 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booster Extension plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'booster_extension_authorbox_shortcode_display' function. This makes it possible for unauthenticated attackers to extract sensitive data including user emails
Product
Booster Extension
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Booster Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Subway – Private Site Option: Sensitive Information ExposureCVE-2024-1678 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's private site feature and view restricted page and post content.
Product
Subway – Private Site Option
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Subway – Private Site Option to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
May 2, 2024Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page: Unauthorized access of dataCVE-2024-0908 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and including, 1.13.4. This makes it possible for unauthenticated attackers to retrieve all post data, including those that may be password protected.
Product
Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page
Affected
up to 1.13.4
What to do
Affects up to 1.13.4. Update Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More: Sensitive Information ExposureCVE-2024-0615 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0 via the API. This makes it possible for unauthenticated attackers to extract post titles, IDs, slugs, statuses and other information including post content. This includes published content only.
Product
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WP Meta SEO: Sensitive Information ExposureCVE-2023-6962 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. This makes it possible for unauthenticated attackers to disclose potentially sensitive information via the meta description of password-protected posts.
Product
WP Meta SEO
Affected
up to 4.5.12
What to do
Affects up to 4.5.12. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WP Show Posts: Unauthorized access of dataCVE-2023-6731 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view arbitrary post metadata, list posts, and view terms and taxonomies.
Product
WP Show Posts
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update WP Show Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024HT Mega – Absolute Addons For Elementor: Sensitive Information ExposureCVE-2023-6214 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchased_products function. This makes it possible for unauthenticatied attackers to extract sensitive data including the previous 7 days of order data including products and customer PII.
Product
HT Mega – Absolute Addons For Elementor
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update HT Mega – Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 29, 2024WP Page Post Widget Clone: Missing AuthorizationCVE-2024-33636 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mahesh Vora WP Page Post Widget Clone.This issue affects WP Page Post Widget Clone: from n/a through 1.0.1.
Product
WP Page Post Widget Clone
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Page Post Widget Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Auto Featured Image (Auto Post Thumbnail): Server-Side Request Forgery (SSRF)CVE-2024-33629 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail).This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through 4.0.0.
Product
Auto Featured Image (Auto Post Thumbnail)
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024User Meta: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-33575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0.
Product
User Meta
Affected
up to 3.0
What to do
Affects up to 3.0. Update User Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Assistant – Every Day Productivity Apps: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-33538 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fastline Media LLC Assistant – Every Day Productivity Apps.This issue affects Assistant – Every Day Productivity Apps: from n/a through 1.4.9.1.
Product
Assistant – Every Day Productivity Apps
Affected
up to 1.4.9.1
What to do
Affects up to 1.4.9.1. Update Assistant – Every Day Productivity Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.