Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

5,864 results · page 40 of 118

May 14, 2024The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization ofCVE-2024-4860 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization of the 'notice_id' GET parameter.
Fixed in
4.23.9
What to do
Update the plugin to 4.23.9 or newer.
Full record and what to do →NVD record tenable.com tenable.com
May 14, 2024WP Compress – Image Optimizer [All-In-One]: Unauthorized modification of dataCVE-2024-4445 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting, in multisite environments.
Product
WP Compress – Image Optimizer [All-In-One]
Affected
up to 6.20.01
What to do
Affects up to 6.20.01. Update WP Compress – Image Optimizer [All-In-One] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2024-4333 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via several parameters in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024WP Compress – Image Optimizer [All-In-One: Open RedirectCVE-2023-6812 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
WP Compress – Image Optimizer [All-In-One
Affected
up to 6.20.01
What to do
Affects up to 6.20.01. Update WP Compress – Image Optimizer [All-In-One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Starter Templates — Elementor, WordPress & Beaver Builder Templates: Stored Cross-Site ScriptingCVE-2024-4630 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Starter Templates — Elementor, WordPress & Beaver Builder Templates
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update Starter Templates — Elementor, WordPress & Beaver Builder Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘title’ pCVE-2024-4490 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘title’ parameter in versions up to, and including, 4.25.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 4.25.0
What to do
Affects up to 4.25.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record elegantthemes.com elegantthemes.com
May 14, 2024LearnPress – WordPress LMS: Bypass to user registrationCVE-2024-4444 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due to missing checks in the 'create_account' function in the checkout. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record inky-knuckle-2c2.notion.site plugins.trac.wordpress.org
May 14, 2024LearnPress – WordPress LMS: Time-based SQL InjectionCVE-2024-4434 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record inky-knuckle-2c2.notion.site plugins.trac.wordpress.org
May 14, 2024Beaver Builder – WordPress Page Builder: Stored Cross-Site ScriptingCVE-2024-4430 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the photo widget crop attribute in all versions up to, and including, 2.8.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Beaver Builder – WordPress Page Builder
Affected
up to 2.8.1.2
What to do
Affects up to 2.8.1.2. Update Beaver Builder – WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024HTML5 Audio Player- Best WordPress Audio Player: Stored Cross-Site ScriptingCVE-2024-4398 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HTML5 Audio Player- Best WordPress Audio Player
Affected
up to 2.2.19
What to do
Affects up to 2.2.19. Update HTML5 Audio Player- Best WordPress Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024LearnPress – WordPress LMS: Arbitrary file uploadsCVE-2024-4397 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and including, 4.2.6.5. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-4316 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.16
What to do
Affects up to 3.9.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-4277 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Joli FAQ SEO – WordPress FAQ: Cross-Site Request ForgeryCVE-2024-4082 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Joli FAQ SEO – WordPress FAQ Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Joli FAQ SEO – WordPress FAQ
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Joli FAQ SEO – WordPress FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024BuddyPress: Stored Cross-Site ScriptingCVE-2024-3974 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BuddyPress
Affected
up to 12.4.0
What to do
Affects up to 12.4.0. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024Beaver Builder – WordPress Page Builder: Stored Cross-Site ScriptingCVE-2024-3923 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link_target parameter in all versions up to, and including, 2.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Beaver Builder – WordPress Page Builder
Affected
up to 2.8.1.1
What to do
Affects up to 2.8.1.1. Update Beaver Builder – WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024LetterPress: Does not have CSRF checks in some placesCVE-2024-3590 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers
Product
LetterPress
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update LetterPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Post Grid Gutenberg Blocks and WordPress Blog
Fixed in
4.0.2
What to do
Update Post Grid Gutenberg Blocks and WordPress Blog to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024TranslatePress: Cross-Site Request Forgery (CSRF)CVE-2024-34827 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hurduban TranslatePress.This issue affects TranslatePress: from n/a through 2.7.5.
Product
TranslatePress
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WebinarPress: Cross-Site Request Forgery (CSRF)CVE-2024-34818 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress.This issue affects WebinarPress: from n/a through 1.33.17.
Product
WebinarPress
Affected
up to 1.33.17
What to do
Affects up to 1.33.17. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024WPCS ( WordPress Custom Search ): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34418 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tech9logy Creators WPCS ( WordPress Custom Search ) allows Stored XSS.This issue affects WPCS ( WordPress Custom Search ): from n/a through 1.1.
Product
WPCS ( WordPress Custom Search )
Affected
up to 1.1
What to do
Affects up to 1.1. Update WPCS ( WordPress Custom Search ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024AppPresser: Missing AuthorizationCVE-2024-32776 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AppPresser Team AppPresser.This issue affects AppPresser: from n/a through 4.3.0.
Product
AppPresser
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update AppPresser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: Missing AuthorizationCVE-2024-32724 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Woo product importer Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through 2.1.1.
Product
Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024SchedulePress: Missing AuthorizationCVE-2024-32717 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper SchedulePress.This issue affects SchedulePress: from n/a through 5.0.8.
Product
SchedulePress
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update SchedulePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permittingCVE-2024-2749 · WordPress plugins & themes · reported by WPScanMedium 5.9
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.
Fixed in
1.6.8
What to do
Update the plugin to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Starter Templates — Elementor, WordPress & Beaver Builder Templates: Server-Side Request ForgeryCVE-2024-1467 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Starter Templates — Elementor, WordPress & Beaver Builder Templates
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update Starter Templates — Elementor, WordPress & Beaver Builder Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 8, 2024Advance WordPress Search: Missing AuthorizationCVE-2022-40218 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4.
Product
Advance WordPress Search
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Advance WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Zotpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34569 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from n/a through <= 7.3.9.
Product
Zotpress
Affected
up to 7.3.9
What to do
Affects up to 7.3.9. Update Zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024LetterPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34568 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeqx LetterPress allows Stored XSS.This issue affects LetterPress: from n/a through 1.2.1.
Product
LetterPress
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update LetterPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Pootle Pagebuilder – WordPress Page builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34573 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pootlepress Pootle Pagebuilder – WordPress Page builder allows Stored XSS.This issue affects Pootle Pagebuilder – WordPress Page builder: from n/a through 5.7.1.
Product
Pootle Pagebuilder – WordPress Page builder
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Pootle Pagebuilder – WordPress Page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2024Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability.CVE-2024-32674 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.
Fixed in
1.1.32
What to do
Update the plugin to 1.1.32 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 6, 2024SEOPress: Authorization Bypass Through User-Controlled KeyCVE-2024-34383 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1.
Product
SEOPress
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Progressive WordPress (PWA): Missing AuthorizationCVE-2024-33937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nico Martin Progressive WordPress (PWA).This issue affects Progressive WordPress (PWA): from n/a through 2.1.13.
Product
Progressive WordPress (PWA)
Affected
up to 2.1.13
What to do
Affects up to 2.1.13. Update Progressive WordPress (PWA) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024iPanorama 360 WordPress Virtual Tour Builder: Missing AuthorizationCVE-2024-33941 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.1.
Product
iPanorama 360 WordPress Virtual Tour Builder
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Giphypress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33927 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team GIPHY Giphypress allows Stored XSS.This issue affects Giphypress: from n/a through 1.6.2.
Product
Giphypress
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Giphypress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outpuCVE-2024-4439 · WordPress plugins & themes · reported by WordfenceHigh 7.2
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
May 2, 2024WordPress Header Builder Plugin – Pearl: Stored Cross-Site ScriptingCVE-2024-4000 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_hb' shortcode in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Header Builder Plugin – Pearl
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update WordPress Header Builder Plugin – Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Unauthorized access, modification, and loss of dataCVE-2024-3942 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.
Product
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update MasterStudy LMS WordPress Plugin – for Online Courses and Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Popup Box – Best WordPress Popup: Unauthorized access of dataCVE-2024-3897 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_create_author AJAX action in all versions up to, and including, 4.3.6. This makes it possible for unauthenticated attackers to enumerate all emails registered on the website.
Product
Popup Box – Best WordPress Popup
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update Popup Box – Best WordPress Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Poll Maker – Best WordPress Poll: Unauthorized access of dataCVE-2024-3601 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_poll_create_author function in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to extract email addresses by enumerating them one character at a time.
Product
Poll Maker – Best WordPress Poll
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update Poll Maker – Best WordPress Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic: Stored Cross-Site ScriptingCVE-2024-3554 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WordPress Backup & Migration: Unauthorized access of dataCVE-2024-3546 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file name is user-provided and not properly sanitized, which allows attackers to read arbitrary log files on the file system.
Product
WordPress Backup & Migration
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer: Unauthorized ld+json description injectionCVE-2024-3287 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to unauthorized ld+json description injection due to a missing capability check on the save_settings function in all versions up to, and including, 3.10.2. This makes it possible for unauthenticated attackers to save schema types.
Product
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer
Affected
up to 3.10.2
What to do
Affects up to 3.10.2. Update SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Ivory Search – WordPress Search: Unauthorized modification of dataCVE-2024-3233 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_create_index() function in all versions up to, and including, 5.5.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger index creation.
Product
Ivory Search – WordPress Search
Affected
up to 5.5.5
What to do
Affects up to 5.5.5. Update Ivory Search – WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Spectra – WordPress Gutenberg Blocks: Path TraversalCVE-2024-3107 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_default_attributes function. This allows authenticated attackers, with contributor-level permissions and above, to read the contents of any files named attributes.php on the server, which can contain sensitive information.
Product
Spectra – WordPress Gutenberg Blocks
Affected
up to 2.12.6
What to do
Affects up to 2.12.6. Update Spectra – WordPress Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor: Stored Cross-Site ScriptingCVE-2024-2967 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 2, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: SQL InjectionCVE-2024-2876 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.14
What to do
Affects up to 5.7.14. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
May 2, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-2867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 4.15.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.15.4
What to do
Affects up to 4.15.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024FileBird – WordPress Media Library Folders & File Manager: Insecure Direct Object ReferenceCVE-2024-2346 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads visible. CVE-2024-35166 may be a duplicate of this issue.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024FileBird – WordPress Media Library Folders & File Manager: Stored Cross-Site ScriptingCVE-2024-2345 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the folder name parameter in all versions up to, and including, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.