Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

250 results · page 4 of 5

Nov 9, 2024Category Ajax Filter: Local File InclusionCVE-2024-10871 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Category Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.2 via the 'params[caf-post-layout]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with a .php extension can be uploaded and included.
Product
Category Ajax Filter
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update Category Ajax Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2024Filter & Grids: Missing AuthorizationCVE-2024-39664 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in YMC Filter & Grids allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Filter & Grids: from n/a through 2.8.33.
Product
Filter & Grids
Affected
up to 2.8.33
What to do
Affects up to 2.8.33. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2024Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49691 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW woo-product-filter allows SQL Injection.This issue affects Product Filter by WBW: from n/a through <= 2.7.0.
Product
Product Filter by WBW
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Product Filter by WooBeWoo: Authorization bypassCVE-2021-4444 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization checks on various functions. This makes it possible for unauthenticated attackers to perform unauthorized actions such as creating new filters and injecting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery.
Product
Product Filter by WooBeWoo
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Product Filter by WooBeWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 6, 2024Themify – WooCommerce Product Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44046 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify – WooCommerce Product Filter themify-wc-product-filter allows Stored XSS.This issue affects Themify – WooCommerce Product Filter: from n/a through <= 1.5.1.
Product
Themify – WooCommerce Product Filter
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Themify – WooCommerce Product Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2024LocateAndFilter: Stored Cross-Site ScriptingCVE-2024-9304 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LocateAndFilter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
LocateAndFilter
Affected
up to 1.6.14
What to do
Affects up to 1.6.14. Update LocateAndFilter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 24, 2024HUSKY – Products Filter Professional for WooCommerce: Insecure Direct Object ReferenceCVE-2024-7491 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woof_messenger_remove_subscr AJAX action due to missing validation on the 'key' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to unsubscribe users from a product notification sign-ups, if they can successfully obtain or brute force the key value for users who signed up to receive notifications. This vulnerability requires the plugin's Products Messenger extension to be enabled.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.6.1
What to do
Affects up to 1.3.6.1. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 23, 2024MDTF – Meta Data and Taxonomies Filter: SQL InjectionCVE-2024-8624 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_select_title' shortcode in all versions up to, and including, 1.3.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MDTF – Meta Data and Taxonomies Filter
Affected
up to 1.3.3.3
What to do
Affects up to 1.3.3.3. Update MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 23, 2024The MDTF – Meta Data and Taxonomies Filter: Arbitrary shortcode executionCVE-2024-8623 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The MDTF – Meta Data and Taxonomies Filter
Affected
up to 1.3.3.3
What to do
Affects up to 1.3.3.3. Update The MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2024WPZOOM Portfolio Lite – Filterable Portfolio: Stored Cross-Site ScriptingCVE-2024-8276 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPZOOM Portfolio Lite – Filterable Portfolio
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update WPZOOM Portfolio Lite – Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2024Search & Filter Pro: Does not sanitise and escape some of its settingsCVE-2024-6481 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Search & Filter Pro
Fixed in
2.5.18
What to do
Update Search & Filter Pro to 2.5.18 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2024Message Filter for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39647 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.1.1.
Product
Message Filter for Contact Form 7
Affected
up to 1.6.1.1
What to do
Affects up to 1.6.1.1. Update Message Filter for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Filter & Grids: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39665 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YMC Filter & Grids allows Stored XSS.This issue affects Filter & Grids: from n/a through 2.9.2.
Product
Filter & Grids
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 20, 2024YITH WooCommerce Ajax Product Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37943 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through <= 5.1.0.
Product
YITH WooCommerce Ajax Product Filter
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update YITH WooCommerce Ajax Product Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 18, 2024Filter & Grids: Is vulnerable to Local File Inclusion via the post_layout parameterCVE-2024-6164 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possible for an unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
Product
Filter & Grids
Fixed in
2.8.33
What to do
Update Filter & Grids to 2.8.33 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 16, 2024HUSKY – Products Filter Professional for WooCommerce: Time-based SQL InjectionCVE-2024-6457 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Blog, Posts and Category Filter for Elementor: Stored Cross-Site ScriptingCVE-2024-4667 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blog, Posts and Category Filter for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post and Category Filter widget in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied 'post_types' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Blog, Posts and Category Filter for Elementor
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Blog, Posts and Category Filter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 21, 2024Themify – WooCommerce Product Filter: Time-based SQL InjectionCVE-2024-6027 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Themify – WooCommerce Product Filter
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Themify – WooCommerce Product Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2024Filter Custom Fields & Taxonomies Light: Missing AuthorizationCVE-2024-32081 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Websupporter Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.
Product
Filter Custom Fields & Taxonomies Light
Affected
up to 1.05
What to do
Affects up to 1.05. Update Filter Custom Fields & Taxonomies Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Premmerce Product Filter for WooCommerce: Missing AuthorizationCVE-2024-31359 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Premmerce Premmerce Product Filter for WooCommerce premmerce-woocommerce-product-filter.This issue affects Premmerce Product Filter for WooCommerce: from n/a through <= 3.7.2.
Product
Premmerce Product Filter for WooCommerce
Affected
up to 3.7.2
What to do
Affects up to 3.7.2. Update Premmerce Product Filter for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Missing AuthorizationCVE-2024-32818 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Insert or Embed Articulate Content into: Is not properly filteringCVE-2024-0757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files
Product
Insert or Embed Articulate Content into
Affected
up to 4.3000000023
What to do
Affects up to 4.3000000023. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 29, 2024HUSKY – Products Filter Professional for WooCommerce: Stored Cross-Site ScriptingCVE-2024-5039 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.5.3
What to do
Affects up to 1.3.5.3. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Incorrect AuthorizationCVE-2024-34434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Misuse.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.2.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3.2
What to do
Affects up to 1.3.3.2. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection')CVE-2024-32680 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUS HUSKY – Products Filter for WooCommerce (formerly WOOF) allows Using Malicious Files, Code Inclusion.This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.2.
Product
HUSKY – Products Filter for WooCommerce (formerly WOOF)
Affected
up to 1.3.5.2
What to do
Affects up to 1.3.5.2. Update HUSKY – Products Filter for WooCommerce (formerly WOOF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode): Stored Cross-Site ScriptingCVE-2024-4446 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagingType’ parameter in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode)
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 26, 2024Filterable Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-4234 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayful Islam Filterable Portfolio allows Stored XSS.This issue affects Filterable Portfolio: from n/a through 1.6.4.
Product
Filterable Portfolio
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode): Stored Cross-Site ScriptingCVE-2024-3929 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Widget Post Overlay block in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode)
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024Quicksand Post Filter jQuery: Missing AuthorizationCVE-2024-24850 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Product
Quicksand Post Filter jQuery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Quicksand Post Filter jQuery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perforCVE-2024-2278 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Fixed in
1.4.4
What to do
Update the plugin to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filtersCVE-2024-2262 · WordPress plugins & themes · reported by WPScanMedium 4.7
Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs
Fixed in
1.4.4
What to do
Update the plugin to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 31, 2024Add Shortcodes Actions And Filters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Simpson Add Shortcodes Actions And Filters allows Reflected XSS.This issue affects Add Shortcodes Actions And Filters: from n/a through 2.10.
Product
Add Shortcodes Actions And Filters
Affected
up to 2.10
What to do
Affects up to 2.10. Update Add Shortcodes Actions And Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Filter Custom Fields & Taxonomies Light: Deserialization of Untrusted DataCVE-2024-31094 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.
Product
Filter Custom Fields & Taxonomies Light
Affected
up to 1.05
What to do
Affects up to 1.05. Update Filter Custom Fields & Taxonomies Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Cross-Site Request Forgery (CSRF)CVE-2024-30462 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.1.
Product
HUSKY – Products Filter for WooCommerce (formerly WOOF)
Affected
up to 1.3.5.1
What to do
Affects up to 1.3.5.1. Update HUSKY – Products Filter for WooCommerce (formerly WOOF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Cross-Site Request Forgery (CSRF)CVE-2024-30457 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.1.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3.1
What to do
Affects up to 1.3.3.1. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024HUSKY – Products Filter Professional for WooCommerce: Local File InclusionCVE-2024-3061 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.5.2
What to do
Affects up to 1.3.5.2. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Reflected XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29906 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Cross-Site Request Forgery (CSRF)CVE-2023-50861 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.
Product
HUSKY – Products Filter for WooCommerce (formerly WOOF)
Affected
up to 1.3.4.3
What to do
Affects up to 1.3.4.3. Update HUSKY – Products Filter for WooCommerce (formerly WOOF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024HUSKY – Products Filter for WooCommerce Professional: Stored Cross-Site ScriptingCVE-2024-1796 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in all versions up to, and including, 1.3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'swoof_slug'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.3.5.1
What to do
Affects up to 1.3.5.1. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 15, 2024HUSKY – Products Filter for WooCommerce Professional: SQL InjectionCVE-2024-1795 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in all versions up to, and including, 1.3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.3.5.2
What to do
Affects up to 1.3.5.2. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 21, 2024Quicksand Post Filter jQuery: Cross-Site Request Forgery (CSRF)CVE-2024-24849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Product
Quicksand Post Filter jQuery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Quicksand Post Filter jQuery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 16, 2024The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability.CVE-2022-3764 · WordPress plugins & themes · reported by WPScanHigh 7.2
The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability.
Fixed in
1.4.6
What to do
Update the plugin to 1.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-SCVE-2021-24432 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-Site Scripting issue.
Fixed in
1.5.4.7
What to do
Update the plugin to 1.5.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 20, 2023HUSKY – Products Filter for WooCommerce Professional: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-40010 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY – Products Filter for WooCommerce Professional.This issue affects HUSKY – Products Filter for WooCommerce Professional: from n/a through 1.3.4.2.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.3.4.2
What to do
Affects up to 1.3.4.2. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Taxonomy filter: Cross-Site Request Forgery (CSRF)CVE-2023-48282 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio Taxonomy filter allows Cross Site Request Forgery.This issue affects Taxonomy filter: from n/a through 2.2.9.
Product
Taxonomy filter
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update Taxonomy filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023HTML filter and csv-file search: Stored Cross-Site ScriptingCVE-2023-5096 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HTML filter and csv-file search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'csvsearch' shortcode in versions up to, and including, 2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HTML filter and csv-file search
Affected
up to 2.7
What to do
Affects up to 2.7. Update HTML filter and csv-file search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 31, 2023HTML filter and csv-file search: Local File InclusionCVE-2023-5099 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of the 'csvsearch' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
HTML filter and csv-file search
Affected
up to 2.7
What to do
Affects up to 2.7. Update HTML filter and csv-file search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 27, 2023VK Filter Search: Stored Cross-Site ScriptingCVE-2023-5705 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
VK Filter Search
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update VK Filter Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.