Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
651 results · page 4 of 14
Mar 25, 2025The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site SCVE-2025-1798 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks.
- Fixed in
- 1.1.2
- What to do
- Update the plugin to 1.1.2 or newer.
Mar 22, 2025Export and Import Users and Customers: Path TraversalCVE-2025-1973 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
- Product
- Export and Import Users and Customers
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: Arbitrary file deletionCVE-2025-1972 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
- Product
- Export and Import Users and Customers
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: PHP Object InjectionCVE-2025-1971 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- Export and Import Users and Customers
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 22, 2025Export and Import Users and Customers: Server-Side Request ForgeryCVE-2025-1970 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Export and Import Users and Customers
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2025Members page only for logged in users: Cross-Site Request Forgery (CSRF)CVE-2025-28901 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Naren Members page only for logged in users members-page-only-for-logged-in-users allows Stored XSS.This issue affects Members page only for logged in users: from n/a through <= 1.4.2.
- Product
- Members page only for logged in users
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Members page only for logged in users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Front End Users: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26877 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.30.
- Product
- Front End Users
- Affected
- up to 3.2.30
- What to do
- Affects up to 3.2.30. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025Coder: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-13726 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Coder
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Coder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 15, 2025Front End Users: Stored Cross-Site ScriptingCVE-2024-13563 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all versions up to, and including, 3.2.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Front End Users
- Affected
- up to 3.2.30
- What to do
- Affects up to 3.2.30. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2025Export All Posts, Products, Orders, Refunds & Users: Sensitive Information ExposureCVE-2024-12315 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack_uci_uploads/exports/ directory which can contain information like exported user data.
- Product
- Export All Posts, Products, Orders, Refunds & Users
- Affected
- up to 2.9.3
- What to do
- Affects up to 2.9.3. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 4, 2025woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orCVE-2025-24373 · WordPress plugins & themes · reported by GitHubMedium 6.3
woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orders. This vulnerability allows unauthorized users to access any PDF document from a store if they: 1. Have access to a guest document link and 2. Replace the URL variable `my-account` with `bulk`. The issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerability compromises the confidentiality of sensitive documents, affecting all stores using the plugin with the guest access option enabled. This issue has been addressed in version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Fixed in
- 4.0.0
- What to do
- Update the plugin to 4.0.0 or newer.
Jan 30, 2025goodlayers-core: Allows users with a subscriber role and above to upload SVGs containing malicious payloadsCVE-2024-12163 · WordPress plugins & themes · reported by WPScanMedium 6.5
The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads.
- Product
- goodlayers-core
- Fixed in
- 2.1.3
- What to do
- Update goodlayers-core to 2.1.3 or newer.
Jan 27, 2025Import and export users and customers: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCVE-2025-24689 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Retrieve Embedded Sensitive Data.This issue affects Import and export users and customers: from n/a through <= 1.27.12.
- Product
- Import and export users and customers
- Affected
- up to 1.27.12
- What to do
- Affects up to 1.27.12. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 17, 2025Moving Users: Sensitive Information ExposureCVE-2024-12637 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Moving Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.05 via the export functionality. The JSON files are stored in predictable locations with guessable file names when exporting user data. This could allow unauthenticated attackers to extract sensitive user data, for instance, email addresses, hashed passwords, and IP addresses.
- Product
- Moving Users
- Affected
- up to 1.05
- What to do
- Affects up to 1.05. Update Moving Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 16, 2025Import Users to MailChimp: Cross-Site Request Forgery (CSRF)CVE-2025-23675 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah Import Users to MailChimp import-users-to-mailchimp allows Stored XSS.This issue affects Import Users to MailChimp: from n/a through <= 1.0.
- Product
- Import Users to MailChimp
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Import Users to MailChimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WP users media: Missing AuthorizationCVE-2023-27428 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Damir Calusic WP users media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP users media: from n/a through 4.2.3.
- Product
- WP users media
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update WP users media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 7, 2024TWChat – Send or receive messages from users: Reflected Cross-Site ScriptingCVE-2024-11374 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The TWChat – Send or receive messages from users plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.0.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- TWChat – Send or receive messages from users
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update TWChat – Send or receive messages from users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 16, 2024Login using WordPress Users ( WP as SAML IDP ): Time-based SQL InjectionCVE-2024-9887 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Login using WordPress Users ( WP as SAML IDP )
- Affected
- up to 1.15.6
- What to do
- Affects up to 1.15.6. Update Login using WordPress Users ( WP as SAML IDP ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 7, 2024The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrCVE-2024-9926 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
- What to do
- Update the plugin to the newest version.
Nov 1, 2024Login As Users: Missing AuthorizationCVE-2024-43982 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login As Users: from n/a through 1.4.3.
- Product
- Login As Users
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Login As Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024UsersWP: Missing AuthorizationCVE-2024-43277 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.15.
- Product
- UsersWP
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Import and export users and customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50413 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through <= 1.27.5.
- Product
- Import and export users and customers
- Affected
- up to 1.27.5
- What to do
- Affects up to 1.27.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress CVE-2022-4973 · WordPress plugins & themes · reported by WordfenceMedium 4.9
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.
- Affected
- up to 6.0.2
- What to do
- Affects up to 6.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcore.trac.wordpress.orgwordpress.org
Oct 9, 2024WP Users Masquerade: Authentication bypassCVE-2024-9522 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajax_masq_login' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.
- Product
- WP Users Masquerade
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update WP Users Masquerade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 8, 2024Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to peCVE-2024-8983 · WordPress plugins & themes · reported by WPScanMedium 4.8
Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Fixed in
- 2.2.3
- What to do
- Update the plugin to 2.2.3 or newer.
Oct 5, 2024Users Control: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44015 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Users Control users-control allows PHP Local File Inclusion.This issue affects Users Control: from n/a through <= 1.0.16.
- Product
- Users Control
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update Users Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024Opti Marketing: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6928 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Opti Marketing
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Opti Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024TrueBooker: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6924 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- TrueBooker
- Fixed in
- 1.0.3
- What to do
- Update TrueBooker to 1.0.3 or newer.
Sep 4, 2024Viral Signup: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6926 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Viral Signup
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Viral Signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024Front End Users: Time-based SQL InjectionCVE-2024-7607 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Front End Users
- Affected
- up to 3.2.28
- What to do
- Affects up to 3.2.28. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024Front End Users: Stored Cross-Site ScriptingCVE-2024-7606 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and including, 3.2.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Front End Users
- Affected
- up to 3.2.28
- What to do
- Affects up to 3.2.28. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 19, 2024Login As Users: Improper Privilege ManagementCVE-2024-43311 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Privilege Management vulnerability in Geek Code Lab Login As Users allows Privilege Escalation.This issue affects Login As Users: from n/a through 1.4.2.
- Product
- Login As Users
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Login As Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024Import and export users and customers: Insertion of Sensitive Information Into Sent DataCVE-2024-38787 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.8.
- Product
- Import and export users and customers
- Affected
- up to 1.26.8
- What to do
- Affects up to 1.26.8. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024Send Users Email: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38760 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Maucher Send Users Email allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Send Users Email: from n/a through 1.5.1.
- Product
- Send Users Email
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Send Users Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2024UsersWP: Uses predictable filenamesCVE-2024-6477 · WordPress plugins & themes · reported by WPScanHigh 7.5
The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address
- Product
- UsersWP
- Fixed in
- 1.2.12
- What to do
- Update UsersWP to 1.2.12 or newer.
Jul 30, 2024CZ Loan Management: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5975 · WordPress plugins & themes · reported by WPScanCritical 9.1
The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- CZ Loan Management
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CZ Loan Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Business Card: Does not prevent high privilege users like administrators from uploading malicious PHP filesCVE-2024-5807 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.
- Product
- Business Card
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Business Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WpStickyBar: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5765 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- WpStickyBar
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024pmpro-member-directory: Does not prevent users with at least the contributor role from leaking other users' sensitive informationCVE-2024-1287 · WordPress plugins & themes · reported by WPScanMedium 6.5
The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.
- Product
- pmpro-member-directory
- Fixed in
- 1.2.6
- What to do
- Update pmpro-member-directory to 1.2.6 or newer.
Jul 30, 2024pmpro-membership-maps: Does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the siteCVE-2024-1286 · WordPress plugins & themes · reported by WPScanMedium 4.9
The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.
- Product
- pmpro-membership-maps
- Fixed in
- 0.7
- What to do
- Update pmpro-membership-maps to 0.7 or newer.
Jul 29, 2024The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PCVE-2024-5882 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PHP files on the server from the listings page
- Product
- Ultimate Classified Listings
- Fixed in
- 1.3
- What to do
- Update Ultimate Classified Listings to 1.3 or newer.
Jul 23, 2024Page Builder Gutenberg Blocks: Does not prevent users from pinging arbitrary hosts via some of its shortcodesCVE-2024-4260 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
- Product
- Page Builder Gutenberg Blocks
- Fixed in
- 3.1.12
- What to do
- Update Page Builder Gutenberg Blocks to 3.1.12 or newer.
Jul 19, 2024PayPlus Payment Gateway: Does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated usersCVE-2024-6205 · WordPress plugins & themes · reported by WPScanCritical 9.8
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
- Product
- PayPlus Payment Gateway
- Fixed in
- 6.6.9
- What to do
- Update PayPlus Payment Gateway to 6.6.9 or newer.
Jul 18, 2024Duplica – Duplicate Posts, Pages, Custom Posts or Users: Unauthorized modification of dataCVE-2024-5997 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Duplica – Duplicate Posts, Pages, Custom Posts or Users plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_user and duplicate_post functions in all versions up to, and including, 0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create duplicates of users and posts/pages.
- Product
- Duplica – Duplicate Posts, Pages, Custom Posts or Users
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update Duplica – Duplicate Posts, Pages, Custom Posts or Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 29, 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Time-based SQL InjectionCVE-2024-6265 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2024kadence-blocks-pro: Does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the databaseCVE-2024-1330 · WordPress plugins & themes · reported by WPScanMedium 4.3
The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database.
- Product
- kadence-blocks-pro
- Fixed in
- 2.3.8
- What to do
- Update kadence-blocks-pro to 2.3.8 or newer.
Jun 14, 2024events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar: Does not prevent users with at least the contributor role from leaking details about events they shouldn't have access toCVE-2024-1295 · WordPress plugins & themes · reported by WPScanMedium 6.5
The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.)
- Product
- events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar
- Fixed in
- 6.4.0.1
- What to do
- Update events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar to 6.4.0.1 or newer.
Jun 13, 2024Web Directory Free: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-3552 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
- Product
- Web Directory Free
- Fixed in
- 1.7.0
- What to do
- Update Web Directory Free to 1.7.0 or newer.
Jun 11, 2024Import and export users and customers: Missing AuthorizationCVE-2024-34815 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.5.
- Product
- Import and export users and customers
- Affected
- up to 1.26.5
- What to do
- Affects up to 1.26.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 8, 2024Import and export users and customers: Missing AuthorizationCVE-2024-22151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.
- Product
- Import and export users and customers
- Affected
- up to 1.24.6
- What to do
- Affects up to 1.24.6. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.