Updated 3 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,491 results · page 40 of 50

Apr 29, 2024Custom field finder: Deserialization of Untrusted DataCVE-2024-33641 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Team Yoast Custom field finder.This issue affects Custom field finder: from n/a through 0.3.
Product
Custom field finder
Affected
up to 0.3
What to do
Affects up to 0.3. Update Custom field finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024XStore Core: Deserialization of Untrusted DataCVE-2024-33553 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.
Product
XStore Core
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Data Tables Generator by Supsystic: Missing AuthorizationCVE-2024-32829 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.10.31.
Product
Data Tables Generator by Supsystic
Affected
up to 1.10.31
What to do
Affects up to 1.10.31. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2024-3988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Fancy Text Widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 25, 2024Classified Listing – Classified ads & Business Directory: Unauthorized loss of dataCVE-2024-3893 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the rtcl_fb_gallery_image_delete AJAX action in all versions up to, and including, 3.0.10.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachements.
Product
Classified Listing – Classified ads & Business Directory
Affected
up to 3.0.10.3
What to do
Affects up to 3.0.10.3. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2024Import Export WordPress Users: Deserialization of Untrusted DataCVE-2024-32835 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3.
Product
Import Export WordPress Users
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Import Export WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Simply Static: Insertion of Sensitive Information Into Sent DataCVE-2024-32825 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through <= 3.1.3.
Product
Simply Static
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Simply Static to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Import and export users and customers: Deserialization of Untrusted DataCVE-2024-32817 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.2.
Product
Import and export users and customers
Affected
up to 1.26.2
What to do
Affects up to 1.26.2. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024WP Fusion Lite: Insertion of Sensitive Information Into Sent DataCVE-2024-32796 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite allows Retrieve Embedded Sensitive Data.This issue affects WP Fusion Lite: from n/a through <= 3.42.10.
Product
WP Fusion Lite
Affected
up to 3.42.10
What to do
Affects up to 3.42.10. Update WP Fusion Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024HT Mega: Insertion of Sensitive Information Into Sent DataCVE-2024-32782 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.4.7.
Product
HT Mega
Affected
up to 2.4.7
What to do
Affects up to 2.4.7. Update HT Mega to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 23, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-3491 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.29
What to do
Affects up to 1.29. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2024Quick Featured Images: Unauthorized modification of dataCVE-2024-3664 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and delete_thumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author.
Product
Quick Featured Images
Affected
up to 13.7.0
What to do
Affects up to 13.7.0. Update Quick Featured Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 19, 2024Genesis Blocks: Does not properly escape data input provided to some of its blocksCVE-2024-2761 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks.
Product
Genesis Blocks
Fixed in
3.1.3
What to do
Update Genesis Blocks to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2024Master Slider: Deserialization of Untrusted DataCVE-2024-32600 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.5.
Product
Master Slider
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WooBuddy: Deserialization of Untrusted DataCVE-2024-32603 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.20.
Product
WooBuddy
Affected
up to 3.4.20
What to do
Affects up to 3.4.20. Update WooBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024PeproDev CF7 Database: Cross-Site Request Forgery (CSRF)CVE-2023-41864 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pepro Dev. Group PeproDev CF7 Database.This issue affects PeproDev CF7 Database: from n/a through 1.8.0.
Product
PeproDev CF7 Database
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update PeproDev CF7 Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Data Tables Generator: Incorrect AuthorizationCVE-2023-25043 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Incorrect Authorization vulnerability in Supsystic Data Tables Generator.This issue affects Data Tables Generator: from n/a through 1.10.25.
Product
Data Tables Generator
Affected
up to 1.10.25
What to do
Affects up to 1.10.25. Update Data Tables Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2024Customer Reviews for WooCommerce: Unauthorized access of dataCVE-2024-3869 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woocommerce_json_search_coupons' function . This makes it possible for attackers with subscriber level access to view coupon codes.
Product
Customer Reviews for WooCommerce
Fixed in
5.47.0
What to do
Update Customer Reviews for WooCommerce to 5.47.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2024Table & Contact Form 7 Database – Tablesome: Cross-Site Request Forgery (CSRF)CVE-2024-31388 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.25.
Product
Table & Contact Form 7 Database – Tablesome
Affected
up to 1.0.25
What to do
Affects up to 1.0.25. Update Table & Contact Form 7 Database – Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Import Users from CSV: Deserialization of Untrusted DataCVE-2024-32431 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2.
Product
Import Users from CSV
Affected
up to 1.2
What to do
Affects up to 1.2. Update Import Users from CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 12, 2024Smart Slider 3: Unauthorized modification of dataCVE-2024-3027 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the upload function in all versions up to, and including, 3.5.1.22. This makes it possible for authenticated attackers, with contributor-level access and above, to upload files, including SVG files, which can be used to conduct stored cross-site scripting attacks.
Product
Smart Slider 3
Affected
up to 3.5.1.22
What to do
Affects up to 3.5.1.22. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024PropertyHive: Deserialization of Untrusted DataCVE-2024-27985 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9.
Product
PropertyHive
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Premium Addons for Elementor: Insertion of Sensitive Information Into Sent DataCVE-2024-31278 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.22.
Product
Premium Addons for Elementor
Affected
up to 4.10.22
What to do
Affects up to 4.10.22. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WP Radio – Worldwide Online Radio Stations Directory for: Unauthorized modification of dataCVE-2024-1042 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 3.1.9. This makes it possible for authenticated attackers, with subscriber access and above, to import radio stations, remove countries, and modify the plugin's settings, which can lead to Cross-Site Scripting, tracked separately in CVE-2024-1041.
Product
WP Radio – Worldwide Online Radio Stations Directory for
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update WP Radio – Worldwide Online Radio Stations Directory for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 9, 2024Relevanssi – A Better Search: Unauthorized modification of dataCVE-2024-3213 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the relevanssi_update_counts() function in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to execute expensive queries on the application that could lead into DOS.
Product
Relevanssi – A Better Search
Affected
up to 4.22.1
What to do
Affects up to 4.22.1. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WordPress Gallery Plugin – NextGEN Gallery: Unauthorized access of dataCVE-2024-3097 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.
Product
WordPress Gallery Plugin – NextGEN Gallery
Affected
up to 3.59
What to do
Affects up to 3.59. Update WordPress Gallery Plugin – NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Permalink Manager Lite: Unauthorized access of dataCVE-2024-2543 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unauthenticated attackers to view the permalinks of all posts.
Product
Permalink Manager Lite
Affected
up to 2.4.3.1
What to do
Affects up to 2.4.3.1. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Apr 9, 2024Advanced Classifieds & Directory Pro: Unauthorized loss of dataCVE-2024-2222 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads.
Product
Advanced Classifieds & Directory Pro
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Graphene: Unauthorized access of dataCVE-2024-1984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Graphene theme for WordPress is vulnerable to unauthorized access of data via meta tag in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated individuals to obtain post contents of password protected posts via the generated source.
Product
Graphene
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Graphene to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Apr 9, 2024WP Compress – Image Optimizer: Unauthorized modification of dataCVE-2024-1934 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all versions up to, and including, 6.11.10. This makes it possible for unauthenticated attackers to reset the CDN region and set a malicious URL to deliver images.
Product
WP Compress – Image Optimizer
Affected
up to 6.11.10
What to do
Affects up to 6.11.10. Update WP Compress – Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024MasterStudy LMS: Unauthorized access of dataCVE-2024-1904 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all versions up to, and including, 3.2.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose draft post titles and excerpts.
Product
MasterStudy LMS
Affected
up to 3.2.13
What to do
Affects up to 3.2.13. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Accordion: Unauthorized access of data and modification of dataCVE-2024-1641 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'accordions_duplicate_post_as_draft' function in all versions up to, and including, 2.2.96. This makes it possible for authenticated attackers, with contributor access and above, to duplicate arbitrary posts, allowing access to the contents of password-protected posts.
Product
Accordion
Affected
up to 2.2.96
What to do
Affects up to 2.2.96. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024360 Javascript Viewer: Unauthorized modification of dataCVE-2024-1637 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access or higher, to update plugin settings.
Product
360 Javascript Viewer
Affected
up to 1.7.12
What to do
Affects up to 1.7.12. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Happy Addons for Elementor: Unauthorized access of dataCVE-2024-1387 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicate_thing() function in all versions up to, and including, 3.10.4. This makes it possible for attackers, with contributor-level access and above, to clone arbitrary posts (including private and password protected ones) which may lead to information exposure.
Product
Happy Addons for Elementor
Affected
up to 3.10.4
What to do
Affects up to 3.10.4. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Classified Listing – Classified ads & Business Directory: Unauthorized access & modification of dataCVE-2024-1352 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtcl_import_location() rtcl_import_category() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.
Product
Classified Listing – Classified ads & Business Directory
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WooCommerce Cloak Affiliate Links: Unauthorized modification of dataCVE-2024-1308 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate links.
Product
WooCommerce Cloak Affiliate Links
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update WooCommerce Cloak Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WooCommerce Clover Payment Gateway: Unauthorized modification of dataCVE-2024-0626 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callback_handler function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to mark orders as paid.
Product
WooCommerce Clover Payment Gateway
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WooCommerce Clover Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2024WP Import Export Lite: Deserialization of Untrusted DataCVE-2024-31308 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.
Product
WP Import Export Lite
Affected
up to 3.9.26
What to do
Affects up to 3.9.26. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Product Designer: Deserialization of Untrusted DataCVE-2024-31277 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32.
Product
Product Designer
Affected
up to 1.0.32
What to do
Affects up to 1.0.32. Update Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2024WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels: Unauthorized modification of dataCVE-2024-3216 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wt_pklist_reset_settings() function in all versions up to, and including, 4.4.2. This makes it possible for unauthenticated attackers to reset all of the plugin's settings.
Product
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 6, 2024WP-Stateless – Google Cloud Storage: Unauthorized loss of dataCVE-2024-1385 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to the current time, which may completely take a site offline.
Product
WP-Stateless – Google Cloud Storage
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update WP-Stateless – Google Cloud Storage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 5, 2024Image Watermark: Unauthorized modification of dataCVE-2024-1994 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Watermark plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the watermark_action_ajax() function in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to apply and remove watermarks from images.
Product
Image Watermark
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Image Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 3, 2024Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when postingCVE-2023-35764 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.3
Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP address when posting.
Fixed in
3.6.4
What to do
Update the plugin to 3.6.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 2, 2024Product Sort and Display for WooCommerce: Unauthorized modification of dataCVE-2024-1807 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Product Sort and Display for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the psad_update_product_cat_custom_meta_ajax function in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to hide product categories.
Product
Product Sort and Display for WooCommerce
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Product Sort and Display for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 2, 2024Sharkdropship for AliExpress Dropshipping and Affiliate: Unauthorized loss of dataCVE-2024-1732 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Sharkdropship for AliExpress Dropshipping and Affiliate plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wads_removeProductFromShop() function in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
Sharkdropship for AliExpress Dropshipping and Affiliate
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Sharkdropship for AliExpress Dropshipping and Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 31, 2024Filter Custom Fields & Taxonomies Light: Deserialization of Untrusted DataCVE-2024-31094 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.
Product
Filter Custom Fields & Taxonomies Light
Affected
up to 1.05
What to do
Affects up to 1.05. Update Filter Custom Fields & Taxonomies Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024WordPress Meta Data and Taxonomies Filter (MDTF): Cross-Site Request Forgery (CSRF)CVE-2024-30457 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.1.
Product
WordPress Meta Data and Taxonomies Filter (MDTF)
Affected
up to 1.3.3.1
What to do
Affects up to 1.3.3.1. Update WordPress Meta Data and Taxonomies Filter (MDTF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Responsive: Unauthorized modification of dataCVE-2024-2848 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Responsive theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_footer_text_callback function in all versions up to, and including, 5.0.2. This makes it possible for unauthenticated attackers to inject arbitrary HTML content into the site's footer.
Product
Responsive
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Mar 29, 2024OceanWP: Unauthorized access of dataCVE-2024-2476 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose sensitive information such as system/environment data and API keys.
Product
OceanWP
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update OceanWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Mar 29, 2024Easy Appointments: Unauthorized modification of dataCVE-2024-2844 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other users orders.
Product
Easy Appointments
Affected
up to 3.11.18
What to do
Affects up to 3.11.18. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.