Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

2,856 results · page 38 of 58

Apr 29, 2024Regenerate post permalink: Cross-Site Request Forgery (CSRF)CVE-2024-33681 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Regenerate post permalink allows Cross-Site Scripting (XSS).This issue affects Regenerate post permalink: from n/a through 1.0.3.
Product
Regenerate post permalink
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Regenerate post permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Advanced Most Recent Posts Mod: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33643 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey Lampert Advanced Most Recent Posts Mod allows Stored XSS.This issue affects Advanced Most Recent Posts Mod: from n/a through 1.6.5.2.
Product
Advanced Most Recent Posts Mod
Affected
up to 1.6.5.2
What to do
Affects up to 1.6.5.2. Update Advanced Most Recent Posts Mod to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 27, 2024WPC Composite Products for WooCommerce: Stored Cross-Site ScriptingCVE-2024-2838 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPC Composite Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooco_components[0][name]' parameter in all versions up to, and including, 7.2.7 due to insufficient input sanitization and output escaping and missing authorization on the ajax_save_components function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPC Composite Products for WooCommerce
Affected
up to 7.2.7
What to do
Affects up to 7.2.7. Update WPC Composite Products for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 26, 2024Post Slider: Missing AuthorizationCVE-2022-40975 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Aazztech Post Slider.This issue affects Post Slider: from n/a through 1.6.7.
Product
Post Slider
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update Post Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Smart Recent Posts Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33692 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Satrya Smart Recent Posts Widget allows Stored XSS.This issue affects Smart Recent Posts Widget: from n/a through 1.0.3.
Product
Smart Recent Posts Widget
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Smart Recent Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Page Builder: Live Composer: Missing AuthorizationCVE-2024-32957 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.38.
Product
Page Builder: Live Composer
Affected
up to 1.5.38
What to do
Affects up to 1.5.38. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions uCVE-2024-3682 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wp-staging.com
Apr 26, 2024Blog2Social: Social Media Auto Post & Scheduler: Sensitive Information ExposureCVE-2024-3678 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. This makes it possible for unauthenticated attackers to view limited information from password protected posts.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 26, 2024Advanced Post List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33642 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EkoJR Advanced Post List allows Stored XSS.This issue affects Advanced Post List: from n/a through 0.5.6.1.
Product
Advanced Post List
Affected
up to 0.5.6.1
What to do
Affects up to 0.5.6.1. Update Advanced Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024WP-Members Membership: Information ExposureCVE-2024-2920 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.
Product
WP-Members Membership
Affected
up to 3.4.9.3
What to do
Affects up to 3.4.9.3. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Fixed in
7.1.0
What to do
Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024MM-email2image: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3075 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
MM-email2image
Affected
up to 0.2.5
What to do
Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2159 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Social Sharing
Fixed in
3.3.61
What to do
Update Social Sharing to 3.3.61 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Sensitive Information ExposureCVE-2024-3733 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.9.15 via the ajax_load_more() , eael_woo_pagination_product_ajax(), and ajax_eael_product_gallery() functions. This makes it possible for unauthenticated attackers to extract posts that may be in private or draft status.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 5.9.15
What to do
Affects up to 5.9.15. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 25, 2024WP Setup Wizard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-25917 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodeRevolution WP Setup Wizard.This issue affects WP Setup Wizard: from n/a through 1.0.8.1.
Product
WP Setup Wizard
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WP Setup Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode): Stored Cross-Site ScriptingCVE-2024-3929 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Widget Post Overlay block in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode)
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2024WP Post Rating: Missing AuthorizationCVE-2023-25785 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shoaib Saleem WP Post Rating allows Functionality Misuse.This issue affects WP Post Rating: from n/a through 2.5.
Product
WP Post Rating
Affected
up to 2.5
What to do
Affects up to 2.5. Update WP Post Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Rate my Post – WP Rating System: Authorization Bypass Through User-Controlled KeyCVE-2024-32823 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in FeedbackWP Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.4.
Product
Rate my Post – WP Rating System
Affected
up to 3.4.4
What to do
Affects up to 3.4.4. Update Rate my Post – WP Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Widget Post Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32801 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin Widget Post Slider allows Stored XSS.This issue affects Widget Post Slider: from n/a through 1.3.5.
Product
Widget Post Slider
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Widget Post Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Post Grid: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32816 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78.
Product
Post Grid
Affected
up to 2.2.78
What to do
Affects up to 2.2.78. Update Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Email Customizer for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32781 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeHigh Email Customizer for WooCommerce.This issue affects Email Customizer for WooCommerce: from n/a through 2.6.0.
Product
Email Customizer for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024VikRentCar: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32780 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in E4J s.R.L. VikRentCar.This issue affects VikRentCar: from n/a through 1.3.2.
Product
VikRentCar
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update VikRentCar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Frontend Dashboard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32726 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in vinoth06. Frontend Dashboard.This issue affects Frontend Dashboard: from n/a through 2.2.2.
Product
Frontend Dashboard
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024StreamWeasels Twitch Integration: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32716 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StreamWeasels StreamWeasels Twitch Integration.This issue affects StreamWeasels Twitch Integration: from n/a through 1.7.8.
Product
StreamWeasels Twitch Integration
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update StreamWeasels Twitch Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Strong Testimonials: Does not validate and escape some of its Testimonial fields before outputting them back in a page/postCVE-2024-3261 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The attack requires a specific view to be performed
Product
Strong Testimonials
Fixed in
3.1.12
What to do
Update Strong Testimonials to 3.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 22, 2024Language Switcher for Transposh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Gasi Language Switcher for Transposh allows Reflected XSS.This issue affects Language Switcher for Transposh: from n/a through 1.5.9.
Product
Language Switcher for Transposh
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Language Switcher for Transposh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32564 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through <= 4.0.1.
Product
PostX
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024QR Code Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32560 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sharabindu QR Code Composer allows Stored XSS.This issue affects QR Code Composer: from n/a through 2.0.3.
Product
QR Code Composer
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update QR Code Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WP 404 Auto Redirect to Similar Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32559 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hwk-fr WP 404 Auto Redirect to Similar Post allows Reflected XSS.This issue affects WP 404 Auto Redirect to Similar Post: from n/a through 1.0.4.
Product
WP 404 Auto Redirect to Similar Post
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WP 404 Auto Redirect to Similar Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Blind Server-Side Request ForgeryCVE-2023-6805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes it possible for authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to modify information from internal services. NOTE: This vulnerability, exploitable by contributor-level users, was was fixed in version 4.4.7. The same vulnerability was fixed for author-level users in version 4.4.8.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 4.4.7
Fixed in
4.4.7
What to do
Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to 4.4.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 17, 2024Related Posts for: Cross-Site Request Forgery (CSRF)CVE-2024-32549 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Microkid Related Posts for WordPress allows Cross-Site Scripting (XSS).This issue affects Related Posts for WordPress: from n/a through 4.0.3.
Product
Related Posts for
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Related Posts for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Radio Player: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32506 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024Citadela Listing: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-32086 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: from n/a through 5.18.1.
Product
Citadela Listing
Affected
up to 5.18.1
What to do
Affects up to 5.18.1. Update Citadela Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Smash Balloon Social Post Feed: Cross-Site Request Forgery (CSRF)CVE-2024-31379 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Smash Balloon Social Post Feed.This issue affects Smash Balloon Social Post Feed: from n/a through 4.2.1.
Product
Smash Balloon Social Post Feed
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Smash Balloon Social Post Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Page Builder: Live Composer: Cross-Site Request Forgery (CSRF)CVE-2024-31933 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.35.
Product
Page Builder: Live Composer
Affected
up to 1.5.35
What to do
Affects up to 1.5.35. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Inline Related Posts: Cross-Site Request Forgery (CSRF)CVE-2024-31426 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Data443 Inline Related Posts.This issue affects Inline Related Posts: from n/a through 3.3.1.
Product
Inline Related Posts
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Inline Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Sync Post With Other Site: Cross-Site Request Forgery (CSRF)CVE-2024-32082 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kamlesh Parmar Sync Post With Other Site sync-post-with-other-site allows Cross Site Request Forgery.This issue affects Sync Post With Other Site: from n/a through <= 1.9.1.
Product
Sync Post With Other Site
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Sync Post With Other Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Responsive Tabs: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1846 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Tabs
Fixed in
4.0.7
What to do
Update Responsive Tabs to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Meta Box: Does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's postsCVE-2024-1204 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
Product
Meta Box
Fixed in
5.9.4
What to do
Update Meta Box to 5.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024WP User Profile Avatar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP User Profile Avatar
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2024Unauthenticated Cross Site Request Forgery (CSRF) in Post Views Counter <= 1.4.4 versions.CVE-2024-31264 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Post Views Counter <= 1.4.4 versions.
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel: Does not have proper authorizationCVE-2024-0881 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel
Fixed in
2.2.76
What to do
Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel to 2.2.76 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2024Convert Post Types: Cross-Site Request Forgery (CSRF)CVE-2024-32108 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stephanie Leary Convert Post Types.This issue affects Convert Post Types: from n/a through 1.4.
Product
Convert Post Types
Affected
up to 1.4
What to do
Affects up to 1.4. Update Convert Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Simple Post Notes: Cross-Site Request Forgery (CSRF)CVE-2024-31935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in BracketSpace Simple Post Notes.This issue affects Simple Post Notes: from n/a through 1.7.6.
Product
Simple Post Notes
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Simple Post Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows): Sensitive Information ExposureCVE-2024-2966 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.6 via the element_pack_ajax_search function. This makes it possible for unauthenticated attackers to extract sensitive data including password protected post details.
Product
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Affected
up to 5.5.6
What to do
Affects up to 5.5.6. Update Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 11, 2024Inline Related Posts: Is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayedCVE-2023-6257 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts
Product
Inline Related Posts
Fixed in
3.6.0
What to do
Update Inline Related Posts to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2024Quicksand Post Filter jQuery: Missing AuthorizationCVE-2024-24850 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Product
Quicksand Post Filter jQuery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Quicksand Post Filter jQuery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Cross-Site Request Forgery (CSRF)CVE-2024-31430 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional, realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: from n/a through 1.0.8.1; BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.1.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Contact Form Email: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-31302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44.
Product
Contact Form Email
Affected
up to 1.3.44
What to do
Affects up to 1.3.44. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Essential Grid Gallery: Sensitive Information ExposureCVE-2024-3235 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Grid Gallery WordPress Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the on_front_ajax_action() function. This makes it possible for unauthenticated attackers to view private and password protected posts that may have private or sensitive information.
Product
Essential Grid Gallery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Essential Grid Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record essential-grid.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.