Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

254 results · page 4 of 6

Feb 18, 2025Smartarget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget smartarget-contact-us allows Stored XSS.This issue affects Smartarget: from n/a through <= 1.5.3.
Product
Smartarget
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Smartarget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025PressMart - Modern Elementor WooCommerce: Arbitrary shortcode executionCVE-2024-13797 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
PressMart - Modern Elementor WooCommerce
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update PressMart - Modern Elementor WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 12, 2025NGG Smart Image Search: Stored Cross-Site ScriptingCVE-2024-13658 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hr_SIS_nextgen_searchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
NGG Smart Image Search
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2025Smart DoFollow: Cross-Site Request Forgery (CSRF)CVE-2025-25152 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow smart-dofollow allows Stored XSS.This issue affects Smart DoFollow: from n/a through <= 1.0.2.
Product
Smart DoFollow
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Smart DoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Smart Countdown FX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25117 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Polonski Smart Countdown FX smart-countdown-fx allows Stored XSS.This issue affects Smart Countdown FX: from n/a through <= 1.5.5.
Product
Smart Countdown FX
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Smart Countdown FX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 30, 2025Alex Reservations: Smart Restaurant Booking: Stored Cross-Site ScriptingCVE-2024-13380 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rr_form' shortcode in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Alex Reservations: Smart Restaurant Booking
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Alex Reservations: Smart Restaurant Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2025WP Smart Tooltip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23669 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nurul Amin WP Smart Tooltip wp-smart-tool-tip allows Stored XSS.This issue affects WP Smart Tooltip: from n/a through <= 1.0.0.
Product
WP Smart Tooltip
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Smart Tooltip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Smart Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22710 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce allows Blind SQL Injection.This issue affects Smart Manager: from n/a through <= 8.52.0.
Product
Smart Manager
Affected
up to 8.52.0
What to do
Affects up to 8.52.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Theme My Ontraport Smartform: Cross-Site Request Forgery (CSRF)CVE-2025-23717 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in itmooti Theme My Ontraport Smartform theme-my-ontraport-smartform allows Stored XSS.This issue affects Theme My Ontraport Smartform: from n/a through <= 1.2.11.
Product
Theme My Ontraport Smartform
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update Theme My Ontraport Smartform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025WP Smart TV: Stored Cross-Site ScriptingCVE-2024-12818 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Smart TV plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tv-video-player' shortcode in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Smart TV
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update WP Smart TV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 13, 2025Smart Agenda: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22506 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vous-en-ligne allows Stored XSS.This issue affects Smart Agenda: from n/a through <= 4.7.
Product
Smart Agenda
Affected
up to 4.7
What to do
Affects up to 4.7. Update Smart Agenda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 11, 2025GatorMail SmartForms: Stored Cross-Site ScriptingCVE-2024-11386 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GatorMail SmartForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gatormailsmartform' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GatorMail SmartForms
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update GatorMail SmartForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 7, 2025Smart Custom Fields: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22308 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Kitajima Smart Custom Fields smart-custom-fields allows Stored XSS.This issue affects Smart Custom Fields: from n/a through <= 5.0.0.
Product
Smart Custom Fields
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Smart Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025PixelYourSite – Your smart PIXEL (TAG) Manager: Cross-Site Request Forgery (CSRF)CVE-2025-22300 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Cross Site Request Forgery.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 10.0.1.2.
Product
PixelYourSite – Your smart PIXEL (TAG) Manager
Affected
up to 10.0.1.2
What to do
Affects up to 10.0.1.2. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025SmartEmailing.cz: Reflected Cross-Site ScriptingCVE-2024-12261 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SmartEmailing.cz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'se-lists-updated' parameter in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SmartEmailing.cz
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update SmartEmailing.cz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 4, 2025WP Smart Import : Import any XML File to: Reflected Cross-Site ScriptingCVE-2024-12701 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Smart Import : Import any XML File to
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Smart Import : Import any XML File to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025Smartsupp – live chat, chatbots, AI and lead generation: Cross-Site Request Forgery (CSRF)CVE-2024-38790 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Smartsupp Smartsupp – live chat, chatbots, AI and lead generation smartsupp-live-chat allows Cross Site Request Forgery.This issue affects Smartsupp – live chat, chatbots, AI and lead generation: from n/a through <= 3.6.
Product
Smartsupp – live chat, chatbots, AI and lead generation
Affected
up to 3.6
What to do
Affects up to 3.6. Update Smartsupp – live chat, chatbots, AI and lead generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Smart Manager: Missing AuthorizationCVE-2024-49687 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through <= 8.45.0.
Product
Smart Manager
Affected
up to 8.45.0
What to do
Affects up to 8.45.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Smart Shopify Product: Missing AuthorizationCVE-2024-56031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Shopify Product: from n/a through <= 1.0.2.
Product
Smart Shopify Product
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Smart Shopify Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 14, 2024Smart PopUp Blaster: Stored Cross-Site ScriptingCVE-2024-12458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart PopUp Blaster
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Smart PopUp Blaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 13, 2024Donations Made Easy – Smart Donations: Missing AuthorizationCVE-2023-38475 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RedNao Donations Made Easy – Smart Donations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
Product
Donations Made Easy – Smart Donations
Affected
up to 4.0.12
What to do
Affects up to 4.0.12. Update Donations Made Easy – Smart Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024Smart Agenda – Prise de rendez-vous en ligne: Stored Cross-Site ScriptingCVE-2024-11781 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart Agenda – Prise de rendez-vous en ligne
Affected
up to 4.6
What to do
Affects up to 4.6. Update Smart Agenda – Prise de rendez-vous en ligne to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2024Smart Forms: Missing AuthorizationCVE-2023-49856 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in EDGARROJAS Smart Forms smart-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Forms: from n/a through <= 2.6.84.
Product
Smart Forms
Affected
up to 2.6.84
What to do
Affects up to 2.6.84. Update Smart Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Smart WooCommerce Search: Missing AuthorizationCVE-2023-30783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0.
Product
Smart WooCommerce Search
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Smart WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024Smart PopUp Blaster: Stored Cross-Site ScriptingCVE-2024-11339 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart PopUp Blaster
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Smart PopUp Blaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 2, 2024Smart Marketing SMS and Newsletters Forms: Missing AuthorizationCVE-2024-53784 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in E-goi Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Marketing SMS and Newsletters Forms: from n/a through <= 5.0.4.
Product
Smart Marketing SMS and Newsletters Forms
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update Smart Marketing SMS and Newsletters Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024SmartLink Dynamic URLs: Cross-Site Request Forgery (CSRF)CVE-2024-51657 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Woopy Plugins SmartLink Dynamic URLs smartlink-dinamic-urls allows Stored XSS.This issue affects SmartLink Dynamic URLs: from n/a through <= 1.1.0.
Product
SmartLink Dynamic URLs
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update SmartLink Dynamic URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Smart Mockups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50537 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Marra Smart Mockups smart-mockups allows Stored XSS.This issue affects Smart Mockups: from n/a through <= 1.2.0.
Product
Smart Mockups
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Smart Mockups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Smart Online Order for Clover: Missing AuthorizationCVE-2024-43254 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a through <= 1.5.6.
Product
Smart Online Order for Clover
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Smart Online Order for Clover: Missing AuthorizationCVE-2024-43253 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a through <= 1.5.6.
Product
Smart Online Order for Clover
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024WPC Smart Messages for WooCommerce: Unauthorized Smar Message activation/deactivationCVE-2024-10437 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajax_enable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate smart messages.
Product
WPC Smart Messages for WooCommerce
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update WPC Smart Messages for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2024WPC Smart Messages for WooCommerce: Local File InclusionCVE-2024-10436 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the get_condition_value function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
WPC Smart Messages for WooCommerce
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update WPC Smart Messages for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024Smart Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49270 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.This issue affects Smart Blocks: from n/a through <= 2.0.
Product
Smart Blocks
Affected
up to 2.0
What to do
Affects up to 2.0. Update Smart Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024WooCommerce Smart Coupons: Authorization bypassCVE-2020-36841 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.
Product
WooCommerce Smart Coupons
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update WooCommerce Smart Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Oct 15, 2024Smart Online Order for Clover: Reflected Cross-Site ScriptingCVE-2024-8787 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Smart Online Order for Clover
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons: Reflected Cross-Site ScriptingCVE-2024-8541 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site administrator into performing an action such as clicking on a link. Please note that this is only exploitable when the 'Leave a Review' notice is present, which occurs after 100 orders are made and disappears after a user dismisses the notice.
Product
Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons
Affected
up to 2.6.5
What to do
Affects up to 2.6.5. Update Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024Smart Online Order for Clover: Stored Cross-Site ScriptingCVE-2024-9895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo_receipt_link shortcode in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart Online Order for Clover
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2024Smart Custom 404 Error Page: Reflected Cross-Site ScriptingCVE-2024-9204 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smart Custom 404 Error Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all versions up to, and including, 11.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Smart Custom 404 Error Page
Affected
up to 11.4.7
What to do
Affects up to 11.4.7. Update Smart Custom 404 Error Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in allCVE-2024-7870 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files.
Affected
up to 9.7.1
What to do
Affects up to 9.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 21, 2024Smart Online Order for Clover: Unauthorized loss of dataCVE-2024-7032 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'moo_deactivateAndClean' function in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to deactivate the plugin and drop all plugin tables from the database.
Product
Smart Online Order for Clover
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 21, 2024Smart Online Order for Clover: Unauthorized modification of dataCVE-2024-7030 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update product and category descriptions, category titles and images, and sort order.
Product
Smart Online Order for Clover
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 12, 2024SmartMag: Insertion of Sensitive Information into Log FileCVE-2024-37930 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in ThemeSphere SmartMag smartmag-responsive-retina-wordpress-magazine.This issue affects SmartMag: from n/a through < 10.1.0.
Product
SmartMag
Affected
up to 9.3.0
What to do
Affects up to 9.3.0. Update SmartMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 21, 2024PixelYourSite – Your smart PIXEL (TAG) Manager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37447 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 9.6.1.1.
Product
PixelYourSite – Your smart PIXEL (TAG) Manager
Affected
up to 9.6.1.1
What to do
Affects up to 9.6.1.1. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024Meks Smart Author Widget: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Meks Meks Smart Author Widget allows Stored XSS.This issue affects Meks Smart Author Widget: from n/a through 1.1.4.
Product
Meks Smart Author Widget
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Meks Smart Author Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 13, 2024Smart Image Gallery: Does not have CSRF check in placeCVE-2024-3632 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Smart Image Gallery
Fixed in
1.0.19
What to do
Update Smart Image Gallery to 1.0.19 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2024SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer: Full Path DisclosureCVE-2024-6556 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.10.8. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer
Affected
up to 3.10.8
What to do
Affects up to 3.10.8. Update SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 2, 2024Shield Security – Smart Bot Blocking & Intrusion Prevention Security: Cross-Site Request ForgeryCVE-2024-4344 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.1.13. This is due to missing or incorrect nonce validation on the exec function. This makes it possible for unauthenticated attackers to disable pin protection for the admin interface of the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Shield Security – Smart Bot Blocking & Intrusion Prevention Security
Affected
up to 19.1.13
What to do
Affects up to 19.1.13. Update Shield Security – Smart Bot Blocking & Intrusion Prevention Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 1, 2024Smartarget Message Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35646 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget Message Bar smartarget-message-bar.This issue affects Smartarget Message Bar: from n/a through <= 1.5.
Product
Smartarget Message Bar
Affected
up to 1.5
What to do
Affects up to 1.5. Update Smartarget Message Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer: Unauthorized ld+json description injectionCVE-2024-3287 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to unauthorized ld+json description injection due to a missing capability check on the save_settings function in all versions up to, and including, 3.10.2. This makes it possible for unauthenticated attackers to save schema types.
Product
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer
Affected
up to 3.10.2
What to do
Affects up to 3.10.2. Update SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 29, 2024Smart Forms: Missing AuthorizationCVE-2024-33593 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RedNao Smart Forms.This issue affects Smart Forms: from n/a through 2.6.91.
Product
Smart Forms
Affected
up to 2.6.91
What to do
Affects up to 2.6.91. Update Smart Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.