Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
309 results · page 4 of 7
Mar 11, 2025Members page only for logged in users: Cross-Site Request Forgery (CSRF)CVE-2025-28901 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Naren Members page only for logged in users members-page-only-for-logged-in-users allows Stored XSS.This issue affects Members page only for logged in users: from n/a through <= 1.4.2.
- Product
- Members page only for logged in users
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Members page only for logged in users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Login Logger: Cross-Site Request Forgery (CSRF)CVE-2025-28866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger login-logger allows Cross Site Request Forgery.This issue affects Login Logger: from n/a through <= 1.2.1.
- Product
- Login Logger
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Login Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2025Alloggio Membership: Authentication BypassCVE-2025-1638 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity through the alloggio_membership_init_rest_api_facebook_login and alloggio_membership_init_rest_api_google_login functions. This makes it possible for unauthenticated attackers to log in as any user, including administrators, without knowing a password.
- Product
- Alloggio Membership
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Alloggio Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 21, 2025Ziggeo: Stored Cross-Site ScriptingCVE-2024-12452 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeo_event' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ziggeo
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Ziggeo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2025WP Event Aggregator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from n/a through <= 1.8.2.
- Product
- WP Event Aggregator
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update WP Event Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2025NGG Smart Image Search: Stored Cross-Site ScriptingCVE-2024-13658 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- NGG Smart Image Search
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 31, 2025WP MediaTagger: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP MediaTagger
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update WP MediaTagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WP MediaTagger: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-13101 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP MediaTagger
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update WP MediaTagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Embed Swagger UI: Stored Cross-Site ScriptingCVE-2024-13700 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Embed Swagger UI
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Embed Swagger UI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 27, 2025WP Triggers Lite: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-13095 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- WP Triggers Lite
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Triggers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WP Triggers Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13094 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP Triggers Lite
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Triggers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025SEO Blogger to WordPress Migration using 301 Redirection: Reflected Cross-Site ScriptingCVE-2024-13422 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- SEO Blogger to WordPress Migration using 301 Redirection
- Affected
- up to 0.4.8
- What to do
- Affects up to 0.4.8. Update SEO Blogger to WordPress Migration using 301 Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2025DF Draggable: Cross-Site Request Forgery (CSRF)CVE-2025-23708 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Dominic Fallows DF Draggable df-draggable allows Stored XSS.This issue affects DF Draggable: from n/a through <= 1.13.2.
- Product
- DF Draggable
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update DF Draggable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Blogger Image Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23689 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a.
- Product
- Blogger Image Import
- What to do
- Update Blogger Image Import to the newest version.
Jan 16, 2025Geotagged Media: Cross-Site Request Forgery (CSRF)CVE-2025-23558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in digitalfisherman Geotagged Media geotagged-media allows Stored XSS.This issue affects Geotagged Media: from n/a through <= 0.3.0.
- Product
- Geotagged Media
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update Geotagged Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WordPress Logging Service: Cross-Site Request Forgery (CSRF)CVE-2025-23510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jan Štětina WordPress Logging Service wordpress-logging-service allows Stored XSS.This issue affects WordPress Logging Service: from n/a through <= 1.5.4.
- Product
- WordPress Logging Service
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update WordPress Logging Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2025WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Arbitrary file uploadsCVE-2025-0394 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Affected
- up to 3.7.3.5
- What to do
- Affects up to 3.7.3.5. Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Groundhogg: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey Groundhogg groundhogg allows Reflected XSS.This issue affects Groundhogg: from n/a through <= 3.7.3.3.
- Product
- Groundhogg
- Affected
- up to 3.7.3.3
- What to do
- Affects up to 3.7.3.3. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Toggles Shortcode and Widget: Stored Cross-Site ScriptingCVE-2024-12207 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Toggles Shortcode and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Toggles Shortcode and Widget
- Affected
- up to 1.14
- What to do
- Affects up to 1.14. Update Toggles Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 2, 2025Taggbox: Cross-Site Request Forgery (CSRF)CVE-2024-38754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Taggbox Taggbox taggbox-widget allows Cross Site Request Forgery.This issue affects Taggbox: from n/a through <= 3.3.
- Product
- Taggbox
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Groundhogg: Cross-Site Request Forgery (CSRF)CVE-2024-37235 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Adrian Tobey Groundhogg groundhogg allows Cross Site Request Forgery.This issue affects Groundhogg: from n/a through <= 3.4.2.3.
- Product
- Groundhogg
- Affected
- up to 3.4.2.3
- What to do
- Affects up to 3.4.2.3. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2024Taeggie Feed: Stored Cross-Site ScriptingCVE-2024-11748 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and including, 0.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Taeggie Feed
- Affected
- up to 0.1.9
- What to do
- Affects up to 0.1.9. Update Taeggie Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2024TagGator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54390 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bouzid Nazim Zitouni TagGator taggator allows Reflected XSS.This issue affects TagGator: from n/a through <= 1.54.
- Product
- TagGator
- Affected
- up to 1.54
- What to do
- Affects up to 1.54. Update TagGator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 14, 2024Ganohrs Toggle Shortcode: Stored Cross-Site ScriptingCVE-2024-12459 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode in all versions up to, and including, 0.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ganohrs Toggle Shortcode
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update Ganohrs Toggle Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024STAGGS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in STAGGS STAGGS staggs allows Reflected XSS.This issue affects STAGGS: from n/a through <= 2.0.0.
- Product
- STAGGS
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update STAGGS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Taggbox: Missing AuthorizationCVE-2023-33215 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Taggbox Taggbox taggbox-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taggbox: from n/a through <= 3.3.
- Product
- Taggbox
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024Arena.IM – Live Blogging for real-time events: Cross-Site Request ForgeryCVE-2024-12526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.1. This is due to missing or incorrect nonce validation on the 'albfre_user_action' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Arena.IM – Live Blogging for real-time events
- Affected
- up to 0.4.1
- What to do
- Affects up to 0.4.1. Update Arena.IM – Live Blogging for real-time events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 12, 2024Arena.IM – Live Blogging for real-time events: Stored Cross-Site ScriptingCVE-2024-12463 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arena_embed_amp' shortcode in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Arena.IM – Live Blogging for real-time events
- Affected
- up to 0.4.1
- What to do
- Affects up to 0.4.1. Update Arena.IM – Live Blogging for real-time events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2024AI Content Writer, RSS Feed to Post, Autoblogging SEO Help: Reflected Cross-Site ScriptingCVE-2024-12156 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- AI Content Writer, RSS Feed to Post, Autoblogging SEO Help
- Affected
- up to 6.1.3
- What to do
- Affects up to 6.1.3. Update AI Content Writer, RSS Feed to Post, Autoblogging SEO Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2024Arena.IM – Live Blogging for real-time events: Stored Cross-Site ScriptingCVE-2024-11384 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode in all versions up to, and including, 0.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Arena.IM – Live Blogging for real-time events
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update Arena.IM – Live Blogging for real-time events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2024Importify (Dropshipping WooCommerce): Insertion of Sensitive Information Into Debugging CodeCVE-2023-49194 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Debugging Code vulnerability in importify Importify (Dropshipping WooCommerce) importify allows Retrieve Embedded Sensitive Data.This issue affects Importify (Dropshipping WooCommerce): from n/a through <= 1.0.4.
- Product
- Importify (Dropshipping WooCommerce)
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Importify (Dropshipping WooCommerce) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Blogger Buzz: Missing AuthorizationCVE-2023-30476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.
- Product
- Blogger Buzz
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Blogger 301 Redirect: Blind time-based SQL InjectionCVE-2024-10645 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Blogger 301 Redirect plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘br’ parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Blogger 301 Redirect
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Blogger 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 9, 2024Reftagger Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51612 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designerken Reftagger Shortcode reftagger-shortcode allows Stored XSS.This issue affects Reftagger Shortcode: from n/a through <= 1.1.
- Product
- Reftagger Shortcode
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Reftagger Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Geotagged Media: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalfisherman Geotagged Media geotagged-media allows Reflected XSS.This issue affects Geotagged Media: from n/a through <= 0.3.0.
- Product
- Geotagged Media
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update Geotagged Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2024RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging: Unauthorized use of functionalityCVE-2024-9583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the wprss_ajax_send_premium_support function in all versions up to, and including, 4.23.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send premium support requests with an attacker-controlled subject line and email address to support allowing them to impersonate the site owner. License information may also be leaked.
- Product
- RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
- Affected
- up to 4.23.12
- What to do
- Affects up to 4.23.12. Update RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 4, 2024Aggregator Advanced Settings: Stored Cross-Site ScriptingCVE-2024-9368 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Aggregator Advanced Settings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Aggregator Advanced Settings
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Aggregator Advanced Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 1, 2024Loggedin – Limit Active Logins: Reflected Cross-Site ScriptingCVE-2024-9228 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Loggedin – Limit Active Logins plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable when the leave a review notice is present.
- Product
- Loggedin – Limit Active Logins
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Loggedin – Limit Active Logins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2024WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file movement and readingCVE-2024-7626 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
- Product
- WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-6282 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-jltma-wrapper-link element in all versions up to, and including 2.0.6.4 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
- Product
- Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
- Affected
- up to 2.0.6.4
- What to do
- Affects up to 2.0.6.4. Update Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024azurecurve Toggle Show/Hide: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43961 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in azurecurve azurecurve Toggle Show/Hide allows Stored XSS.This issue affects azurecurve Toggle Show/Hide: from n/a through 2.1.3.
- Product
- azurecurve Toggle Show/Hide
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update azurecurve Toggle Show/Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 22, 2024Groundhogg: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37264 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Groundhogg Inc. Groundhogg allows Reflected XSS.This issue affects Groundhogg: from n/a through 3.4.2.3.
- Product
- Groundhogg
- Affected
- up to 3.4.2.3
- What to do
- Affects up to 3.4.2.3. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 20, 2024WP Event Aggregator: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38703 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9.
- Product
- WP Event Aggregator
- Affected
- up to 1.7.9
- What to do
- Affects up to 1.7.9. Update WP Event Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 16, 2024RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging: Unauthorized modification of dataCVE-2024-6621 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprss_activate_feed_source' and 'wprss_pause_feed_source' functions in all versions up to, and including, 4.23.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or pause existing RSS feeds.
- Product
- RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
- Affected
- up to 4.23.11
- What to do
- Affects up to 4.23.11. Update RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 7, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-5542 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Navigation Menu widget of the plugin's Mega Menu extension in all versions up to, and including, 2.0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
- Affected
- up to 2.0.6.1
- What to do
- Affects up to 2.0.6.1. Update Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 7, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Unauthorized modification of dataCVE-2024-5382 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.
- Product
- Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
- Affected
- up to 2.0.6.1
- What to do
- Affects up to 2.0.6.1. Update Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 4, 2024WP Content Pilot – Autoblogging & Affiliate Marketing: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-45053 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing Plugin allows Code Injection.This issue affects WP Content Pilot – Autoblogging & Affiliate Marketing Plugin: from n/a through 1.3.3.
- Product
- WP Content Pilot – Autoblogging & Affiliate Marketing
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update WP Content Pilot – Autoblogging & Affiliate Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!: Stored Cross-Site ScriptingCVE-2024-5485 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Trigger Link shortcode in all versions up to, and including, 1.0.47 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!
- Affected
- up to 1.0.47
- What to do
- Affects up to 1.0.47. Update SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 30, 2024POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications: Time-based SQL InjectionCVE-2024-5207 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator access or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications
- Affected
- up to 2.9.3
- What to do
- Affects up to 2.9.3. Update POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 21, 2024Sailthru Triggermail: Does not sanitise and escape some of its settingsCVE-2024-4290 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.