Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

326 results · page 4 of 7

Oct 22, 2024Category and Taxonomy Meta Fields: Stored Cross-Site ScriptingCVE-2024-9590 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in the 'wpaft_add_meta_textinput' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Category and Taxonomy Meta Fields
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2024Category and Taxonomy Meta Fields: Stored Cross-Site ScriptingCVE-2024-9589 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in the 'wpaft_option_page' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Category and Taxonomy Meta Fields
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2024Category and Taxonomy Meta Fields: Cross-Site Request ForgeryCVE-2024-9588 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible for unauthenticated attackers to add and delete taxonomy meta, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Category and Taxonomy Meta Fields
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 17, 2024G Meta Keywords: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49301 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sinan Yorulmaz G Meta Keywords g-meta-keywords allows Stored XSS.This issue affects G Meta Keywords: from n/a through <= 1.4.
Product
G Meta Keywords
Affected
up to 1.4
What to do
Affects up to 1.4. Update G Meta Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Timetable and Event Schedule by MotoPress: Authorization bypassCVE-2020-36840 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.
Product
Timetable and Event Schedule by MotoPress
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Timetable and Event Schedule by MotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 6, 2024Meta slider and carousel with lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47307 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Essential Plugin Meta slider and carousel with lightbox meta-slider-and-carousel-with-lightbox allows Stored XSS.This issue affects Meta slider and carousel with lightbox: from n/a through <= 2.0.1.
Product
Meta slider and carousel with lightbox
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Meta slider and carousel with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2024RumbleTalk Live Group Chat – HTML5: Stored Cross-Site ScriptingCVE-2024-8720 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RumbleTalk Live Group Chat – HTML5 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rumbletalk-admin-button' shortcode in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RumbleTalk Live Group Chat – HTML5
Affected
up to 6.3.0
What to do
Affects up to 6.3.0. Update RumbleTalk Live Group Chat – HTML5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2024MDTF – Meta Data and Taxonomies Filter: SQL InjectionCVE-2024-8624 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_select_title' shortcode in all versions up to, and including, 1.3.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MDTF – Meta Data and Taxonomies Filter
Affected
up to 1.3.3.3
What to do
Affects up to 1.3.3.3. Update MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 23, 2024The MDTF – Meta Data and Taxonomies Filter: Arbitrary shortcode executionCVE-2024-8623 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The MDTF – Meta Data and Taxonomies Filter
Affected
up to 1.3.3.3
What to do
Affects up to 1.3.3.3. Update The MDTF – Meta Data and Taxonomies Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2024Roseta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45451 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Roseta roseta allows Stored XSS.This issue affects Roseta: from n/a through <= 1.3.0.
Product
Roseta
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Roseta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45456 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.
Product
WP Meta SEO
Affected
up to 4.5.13
What to do
Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 15, 2024WP Meta SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45455 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomUnited WP Meta SEO wp-meta-seo allows Stored XSS.This issue affects WP Meta SEO: from n/a through <= 4.5.13.
Product
WP Meta SEO
Affected
up to 4.5.13
What to do
Affects up to 4.5.13. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Greenshift Query and Meta Addon: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43942 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Query and Meta Addon allows SQL Injection.This issue affects Greenshift Query and Meta Addon: from n/a before 3.9.2.
Product
Greenshift Query and Meta Addon
Fixed in
3.9.2
What to do
Update Greenshift Query and Meta Addon to 3.9.2 or newer.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Meta Field Block: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43278 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Phi Phan Meta Field Block allows Stored XSS.This issue affects Meta Field Block: from n/a through 1.2.13.
Product
Meta Field Block
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update Meta Field Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Timetable and Event Schedule: Deserialization of Untrusted DataCVE-2024-39630 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedule: from n/a through 2.4.13.
Product
Timetable and Event Schedule
Affected
up to 2.4.13
What to do
Affects up to 2.4.13. Update Timetable and Event Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2024Event post: Unauthorized bulk metadata updateCVE-2024-1375 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the save_bulkdatas function in all versions up to, and including, 5.9.10. This makes it possible for unauthenticated attackers to update post_meta_data via a forged request, granted they can trick a logged-in user into performing an action such as clicking on a link.
Product
Event post
Affected
up to 5.9.10
What to do
Affects up to 5.9.10. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2024Post Meta Data Manager: Stored Cross-Site ScriptingCVE-2024-6264 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Meta Data Manager
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 28, 2024Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce: Reflected Cross-Site ScriptingCVE-2024-6288 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tiktok_user_id’ parameter in all versions up to, and including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Affected
up to 7.1.0
What to do
Affects up to 7.1.0. Update Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar: Does not prevent users with at least the contributor role from leaking details about events they shouldn't have access toCVE-2024-1295 · WordPress plugins & themes · reported by WPScanMedium 6.5
The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. password-protected events, drafts, etc.)
Product
events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar
Fixed in
6.4.0.1
What to do
Update events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar to 6.4.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 9, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Missing AuthorizationCVE-2024-32818 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 1, 2024Uploadcare File Uploader and Adaptive Delivery (beta): Cross-Site Request Forgery (CSRF)CVE-2024-35636 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery (beta) uploadcare.This issue affects Uploadcare File Uploader and Adaptive Delivery (beta): from n/a through 3.0.11.
Product
Uploadcare File Uploader and Adaptive Delivery (beta)
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update Uploadcare File Uploader and Adaptive Delivery (beta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 24, 2024Event post: Unauthorized bulk metadata updateCVE-2024-1376 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. This makes it possible for authenticated attackers, with subscriber access or higher, to update post_meta_data.
Product
Event post
Affected
up to 5.9.4
What to do
Affects up to 5.9.4. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 17, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Incorrect AuthorizationCVE-2024-34434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Misuse.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.2.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3.2
What to do
Affects up to 1.3.3.2. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024WP Meta SEO: Sensitive Information ExposureCVE-2023-6962 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. This makes it possible for unauthenticated attackers to disclose potentially sensitive information via the meta description of password-protected posts.
Product
WP Meta SEO
Affected
up to 4.5.12
What to do
Affects up to 4.5.12. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WP Meta SEO: Stored Cross-Site ScriptingCVE-2023-6961 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Meta SEO
Affected
up to 4.5.12
What to do
Affects up to 4.5.12. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 29, 2024User Meta: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-33575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0.
Product
User Meta
Affected
up to 3.0
What to do
Affects up to 3.0. Update User Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 27, 2024Timetable and Event Schedule by MotoPress: SQL InjectionCVE-2024-3342 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in all versions up to, and including, 2.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Timetable and Event Schedule by MotoPress
Affected
up to 2.4.11
What to do
Affects up to 2.4.11. Update Timetable and Event Schedule by MotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 15, 2024Meta Box: Does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's postsCVE-2024-1204 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
Product
Meta Box
Fixed in
5.9.4
What to do
Update Meta Box to 5.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2024Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows: Stored Cross-Site ScriptingCVE-2024-3285 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'metaslider' shortcode in all versions up to, and including, 3.70.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows
Affected
up to 3.70.0
What to do
Affects up to 3.70.0. Update Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2024Hubbub Lite: Does not ensure that user have access to password protected post before displaying its content in a meta tagCVE-2024-1526 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its content in a meta tag.
Product
Hubbub Lite
Fixed in
1.33.1
What to do
Update Hubbub Lite to 1.33.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 29, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Cross-Site Request Forgery (CSRF)CVE-2024-30457 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.1.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3.1
What to do
Affects up to 1.3.3.1. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Meta Tag Manager: PHP Object InjectionCVE-2024-1770 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted input in the get_post_data function. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Meta Tag Manager
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Meta Tag Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Reflected XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29906 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce: SQL InjectionCVE-2024-1203 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Affected
up to 7.0.7
What to do
Affects up to 7.0.7. Update Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2024Paid Memberships Pro: Does not prevent user with at least the contributor role from leaking other users' sensitive metadataCVE-2024-1279 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata.
Product
Paid Memberships Pro
Fixed in
2.12.9
What to do
Update Paid Memberships Pro to 2.12.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2024Royal Elementor Addons and Templates: Unauthorized post metadata updateCVE-2024-0516 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_update_form_action_meta function in all versions up to, and including, 1.3.87. This makes it possible for unauthenticated attackers to update certain metadata.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.87
What to do
Affects up to 1.3.87. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce: Time-based SQL InjectionCVE-2024-0786 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ee_syncProductCategory function using the parameters conditionData, valueData, productArray, exclude and include in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Affected
up to 7.0.7
What to do
Affects up to 7.0.7. Update Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Meta Box – WordPress Custom Fields Framework: Stored Cross-Site ScriptingCVE-2023-6526 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Meta Box – WordPress Custom Fields Framework
Affected
up to 5.9.2
What to do
Affects up to 5.9.2. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2024WP Blogs' Planetarium: Does not have CSRF check in placeCVE-2023-6532 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Blogs' Planetarium WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP Blogs' Planetarium
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Blogs' Planetarium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Dec 26, 2023The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tagCVE-2023-6250 · WordPress plugins & themes · reported by WPScanHigh 7.5
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag
Product
BestWebSoft's Like & Share
Fixed in
2.74
What to do
Update BestWebSoft's Like & Share to 2.74 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Quttera Web Malware Scanner: Doesn't restrict access to detailed scan logsCVE-2023-6065 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code
Product
Quttera Web Malware Scanner
Fixed in
3.4.2.1
What to do
Update Quttera Web Malware Scanner to 3.4.2.1 or newer.
Full record and what to do →NVD record drive.google.com wpscan.com
Nov 27, 2023The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tagsCVE-2023-5845 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tags
Product
Simple Social Media Share Buttons
Fixed in
5.1.1
What to do
Update Simple Social Media Share Buttons to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2023Delete Usermeta: Cross-Site Request ForgeryCVE-2023-5537 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing nonce validation on the delumet_options_page() function. This makes it possible for unauthenticated attackers to remove user meta for arbitrary users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Delete Usermeta
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Delete Usermeta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2023Post Meta Data Manager: Cross-Site Request ForgeryCVE-2023-5776 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the pmdm_wp_ajax_delete_meta, pmdm_wp_delete_user_meta, and pmdm_wp_delete_user_meta functions. This makes it possible for unauthenticated attackers to delete arbitrary user, term, and post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Post Meta Data Manager
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Nov 18, 2023Google Site Verification plugin using Meta Tag: Cross-Site Request Forgery (CSRF)CVE-2023-32514 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Himanshu Parashar Google Site Verification plugin using Meta Tag.This issue affects Google Site Verification plugin using Meta Tag: from n/a through 1.2.
Product
Google Site Verification plugin using Meta Tag
Affected
up to 1.2
What to do
Affects up to 1.2. Update Google Site Verification plugin using Meta Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 13, 2023Extra User Details: Cross-Site Request Forgery (CSRF)CVE-2023-35877 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Vadym K. Extra User Details allows Stored XSS.This issue affects Extra User Details: from n/a through 0.5.
Product
Extra User Details
Affected
up to 0.5
What to do
Affects up to 0.5. Update Extra User Details to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin <= 2.5 versions.CVE-2023-46618 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin <= 2.5 versions.
Affected
up to 2.5
What to do
Affects up to 2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023WP Meta and Date Remover: Provides an AJAX endpoint for configuring the plugin settingsCVE-2023-4823 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.
Product
WP Meta and Date Remover
Fixed in
2.2.0
What to do
Update WP Meta and Date Remover to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.