Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,857 results · page 43 of 58

Dec 29, 2023Product Catalog Simple: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51687 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.This issue affects Product Catalog Simple: from n/a through 1.7.6.
Product
Product Catalog Simple
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023AI Power: Complete AI Pack – Powered by GPT-4: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51527 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.2.
Product
AI Power: Complete AI Pack – Powered by GPT-4
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update AI Power: Complete AI Pack – Powered by GPT-4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023TheGem - Creative Multi-Purpose & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50892 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9.1.
Product
TheGem - Creative Multi-Purpose & WooCommerce
Affected
up to 5.9.1
What to do
Affects up to 5.9.1. Update TheGem - Creative Multi-Purpose & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication –CVE-2022-44589 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1.
Affected
up to 5.6.1
What to do
Affects up to 5.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Booked - Appointment Booking for WordPress | Calendars: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-36399 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.
Product
Booked - Appointment Booking for WordPress | Calendars
Fixed in
2.4.4
What to do
Update Booked - Appointment Booking for WordPress | Calendars to 2.4.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-27447 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.0.4.
Product
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
Affected
up to 6.0.4
What to do
Affects up to 6.0.4. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 26, 2023The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tagCVE-2023-6250 · WordPress plugins & themes · reported by WPScanHigh 7.5
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag
Product
BestWebSoft's Like & Share
Fixed in
2.74
What to do
Update BestWebSoft's Like & Share to 2.74 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2023Rate my Post – WP Rating System: Authorization Bypass Through User-Controlled KeyCVE-2023-49765 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.1.
Product
Rate my Post – WP Rating System
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update Rate my Post – WP Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Dashicons + Custom Post Types: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-22674 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Hal Gatewood Dashicons + Custom Post Types.This issue affects Dashicons + Custom Post Types: from n/a through 1.0.2.
Product
Dashicons + Custom Post Types
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Dashicons + Custom Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023BigCommerce For: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49162 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BigCommerce BigCommerce For WordPress.This issue affects BigCommerce For WordPress: from n/a through 5.0.6.
Product
BigCommerce For
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update BigCommerce For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WordPress Job Board and Recruitment Plugin – JobWP: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48288 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.1.
Product
WordPress Job Board and Recruitment Plugin – JobWP
Affected
up to 2.1
What to do
Affects up to 2.1. Update WordPress Job Board and Recruitment Plugin – JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Export All Posts, Products, Orders, Refunds & Users: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-2487 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WordPress Email Marketing Plugin – WP Email Capture: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-28421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture.This issue affects WordPress Email Marketing Plugin – WP Email Capture: from n/a through 3.10.
Product
WordPress Email Marketing Plugin – WP Email Capture
Affected
up to 3.10
What to do
Affects up to 3.10. Update WordPress Email Marketing Plugin – WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Soledad – Multipurpose, Newspaper, Blog & WooCommerce: Deserialization of Untrusted DataCVE-2023-49826 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Product
Soledad – Multipurpose, Newspaper, Blog & WooCommerce
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Soledad – Multipurpose, Newspaper, Blog & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023AppMySite – Create an app with the Best Mobile App Builder: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49762 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AppMySite AppMySite – Create an app with the Best Mobile App Builder.This issue affects AppMySite – Create an app with the Best Mobile App Builder: from n/a through 3.11.0.
Product
AppMySite – Create an app with the Best Mobile App Builder
Affected
up to 3.11.0
What to do
Affects up to 3.11.0. Update AppMySite – Create an app with the Best Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WoodMart - Multipurpose WooCommerce: Deserialization of Untrusted DataCVE-2023-32242 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36.
Product
WoodMart - Multipurpose WooCommerce
Affected
up to 1.0.36
What to do
Affects up to 1.0.36. Update WoodMart - Multipurpose WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023User Submitted Posts – Enable Users to Submit Posts from the Front End: Unrestricted Upload of File with Dangerous TypeCVE-2023-45603 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts – Enable Users to Submit Posts from the Front End: from n/a through 20230902.
Product
User Submitted Posts – Enable Users to Submit Posts from the Front End
Affected
up to 20230902
What to do
Affects up to 20230902. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unrestricted Upload of File with Dangerous TypeCVE-2023-40204 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager.This issue affects Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: from n/a through 2.9.2.
Product
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Popup Maker – Popup for opt-ins, lead gen, & more: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-47597 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1.
Product
Popup Maker – Popup for opt-ins, lead gen, & more
Affected
up to 1.17.1
What to do
Affects up to 1.17.1. Update Popup Maker – Popup for opt-ins, lead gen, & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Soledad – Multipurpose, Newspaper, Blog & WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49825 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Product
Soledad – Multipurpose, Newspaper, Blog & WooCommerce
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Soledad – Multipurpose, Newspaper, Blog & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Flatsome | Multi-Purpose Responsive WooCommerce: Deserialization of Untrusted DataCVE-2023-40555 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.
Product
Flatsome | Multi-Purpose Responsive WooCommerce
Affected
up to 3.17.5
What to do
Affects up to 3.17.5. Update Flatsome | Multi-Purpose Responsive WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Media File Renamer: Rename Files (Manual, Auto & AI): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects Media File Renamer: Rename Files (Manual, Auto & AI): from n/a through 5.6.9.
Product
Media File Renamer: Rename Files (Manual, Auto & AI)
Affected
up to 5.6.9
What to do
Affects up to 5.6.9. Update Media File Renamer: Rename Files (Manual, Auto & AI) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Aruba HiSpeed Cache: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44983 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.6.
Product
Aruba HiSpeed Cache
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Aruba HiSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44982 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.
Product
Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)
Affected
up to 6.4.5
What to do
Affects up to 6.4.5. Update Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Delete Duplicate Posts: Missing AuthorizationCVE-2023-47754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Clever plugins Delete Duplicate Posts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Delete Duplicate Posts: from n/a through 4.8.9.
Product
Delete Duplicate Posts
Affected
up to 4.8.9
What to do
Affects up to 4.8.9. Update Delete Duplicate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023WP Report Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-34168 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Raven WP Report Post allows SQL Injection.This issue affects WP Report Post: from n/a through 2.1.2.
Product
WP Report Post
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update WP Report Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted requestCVE-2023-6203 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request
Product
Events Calendar
Fixed in
6.2.8.1
What to do
Update Events Calendar to 6.2.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Slider: Does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the requestCVE-2023-6077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
Product
Slider
Fixed in
3.5.12
What to do
Update Slider to 3.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023SmartCrawl: Does not prevent unauthorised users from accessing password-protected posts' contentCVE-2023-5949 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
Product
SmartCrawl
Fixed in
3.8.3
What to do
Update SmartCrawl to 3.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Canada Post Shipping Method: Cross-Site Request Forgery (CSRF)CVE-2023-47789 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.
Product
Canada Post Shipping Method
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update Canada Post Shipping Method to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Custom Post Type Page Template: Cross-Site Request Forgery (CSRF)CVE-2023-50372 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a through 1.1.
Product
Custom Post Type Page Template
Affected
up to 1.1
What to do
Affects up to 1.1. Update Custom Post Type Page Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023NextScripts: Social Networks Auto-Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49183 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts: Social Networks Auto-Poster allows Reflected XSS.This issue affects NextScripts: Social Networks Auto-Poster: from n/a through 4.4.2.
Product
NextScripts: Social Networks Auto-Poster
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update NextScripts: Social Networks Auto-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023List all posts by Authors, nested Categories and Titles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49182 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Marzocca List all posts by Authors, nested Categories and Titles allows Reflected XSS.This issue affects List all posts by Authors, nested Categories and Titles: from n/a through 2.7.10.
Product
List all posts by Authors, nested Categories and Titles
Affected
up to 2.7.10
What to do
Affects up to 2.7.10. Update List all posts by Authors, nested Categories and Titles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Automatic Youtube Video Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49180 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ternstyle LLC Automatic Youtube Video Posts Plugin allows Stored XSS.This issue affects Automatic Youtube Video Posts Plugin: from n/a through 5.2.2.
Product
Automatic Youtube Video Posts
Affected
up to 5.2.2
What to do
Affects up to 5.2.2. Update Automatic Youtube Video Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49179 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored XSS.This issue affects Event post: from n/a through 5.8.6.
Product
Event post
Affected
up to 5.8.6
What to do
Affects up to 5.8.6. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Multiple Post Passwords: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49157 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andreas Münch Multiple Post Passwords allows Stored XSS.This issue affects Multiple Post Passwords: from n/a through 1.1.1.
Product
Multiple Post Passwords
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Multiple Post Passwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Soledad – Multipurpose, Newspaper, Blog & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49827 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Product
Soledad – Multipurpose, Newspaper, Blog & WooCommerce
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Soledad – Multipurpose, Newspaper, Blog & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Display Custom Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48317 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Vatsa Display Custom Post allows Stored XSS.This issue affects Display Custom Post: from n/a through 2.2.1.
Product
Display Custom Post
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Display Custom Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Q2W3 Post Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47521 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Bond, AndreSC Q2W3 Post Order allows Reflected XSS.This issue affects Q2W3 Post Order: from n/a through 1.2.8.
Product
Q2W3 Post Order
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Q2W3 Post Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Enfold - Responsive Multi-Purpose: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-38400 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Reflected XSS.This issue affects Enfold - Responsive Multi-Purpose Theme: from n/a through 5.6.4.
Product
Enfold - Responsive Multi-Purpose
Affected
up to 5.6.4
What to do
Affects up to 5.6.4. Update Enfold - Responsive Multi-Purpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Delete Post Revisions In: Cross-Site Request Forgery (CSRF)CVE-2023-48754 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wap Nepal Delete Post Revisions In WordPress allows Cross Site Request Forgery.This issue affects Delete Post Revisions In WordPress: from n/a through 4.6.
Product
Delete Post Revisions In
Affected
up to 4.6
What to do
Affects up to 4.6. Update Delete Post Revisions In to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Author Box, Guest Author and Co-Authors for Your Posts – Molongui: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-39921 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molongui Author Box, Guest Author and Co-Authors for Your Posts – Molongui allows Stored XSS.This issue affects Author Box, Guest Author and Co-Authors for Your Posts – Molongui: from n/a through 4.6.19.
Product
Author Box, Guest Author and Co-Authors for Your Posts – Molongui
Affected
up to 4.6.19
What to do
Affects up to 4.6.19. Update Author Box, Guest Author and Co-Authors for Your Posts – Molongui to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Premium Addons PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-37868 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
Product
Premium Addons PRO
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Premium Addons PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email download link: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.
Product
Email download link
Affected
up to 3.7
What to do
Affects up to 3.7. Update Email download link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.64.
Product
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
Affected
up to 1.0.64
What to do
Affects up to 1.0.64. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Zippy: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-26533 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.1.
Product
Zippy
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Zippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Libsyn Publisher Hub: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-25057 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.3.2.
Product
Libsyn Publisher Hub
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Libsyn Publisher Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Booster for WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48333 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce.This issue affects Booster for WooCommerce: from n/a through 7.1.1.
Product
Booster for WooCommerce
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Image Regenerate & Select Crop: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-46820 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Image Regenerate & Select Crop: from n/a through 7.3.0.
Product
Image Regenerate & Select Crop
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update Image Regenerate & Select Crop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Libsyn Publisher Hub: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-45834 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.4.4.
Product
Libsyn Publisher Hub
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Libsyn Publisher Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.