Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

5,864 results · page 45 of 118

Jan 30, 2024the 'id' parameter in the 'get_view' function: The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injectionCVE-2024-1061 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.6
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.
Product
the 'id' parameter in the 'get_view' function
Fixed in
2.5.25
What to do
Update the 'id' parameter in the 'get_view' function to 2.5.25 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Jan 30, 2024MapPress Maps for: Stored Cross-Site ScriptingCVE-2023-7225 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MapPress Maps for
Affected
up to 2.88.16
What to do
Affects up to 2.88.16. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Jan 29, 2024The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which providesCVE-2023-7204 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides
Product
WP STAGING WordPress Backup
Fixed in
3.2.0
What to do
Update WP STAGING WordPress Backup to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private postsCVE-2023-7199 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request
Product
Relevanssi
Fixed in
4.22.0
What to do
Update Relevanssi to 4.22.0 or newer.
Full record and what to do →NVD record wpscan.com relevanssi.com
Jan 29, 2024WordPress Users: Does not have CSRF check in placeCVE-2023-6390 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
WordPress Users
Affected
up to 1.4
What to do
Affects up to 1.4. Update WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 29, 2024WordPress Toolbar: Redirects to any URL via the "wptbto" parameterCVE-2023-6389 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
WordPress Toolbar
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update WordPress Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 29, 2024The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication.CVE-2024-0212 · WordPress plugins & themes · reported by cna@cloudflare.comHigh 8.1
The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.
Fixed in
4.12.3
What to do
Update the plugin to 4.12.3 or newer.
Full record and what to do →NVD record github.com github.com
Jan 27, 2024Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: Stored Cross-Site ScriptingCVE-2024-0618 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported form titles in all versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Jan 26, 2024WordPress Simple Shopping Cart: Stored Cross-Site ScriptingCVE-2023-6497 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up to and including 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WordPress Simple Shopping Cart
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2024SEOPress: Does not sanitise and escape some of its settingsCVE-2023-6290 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
SEOPress
Fixed in
7.3
What to do
Update SEOPress to 7.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 19, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Deserialization of Untrusted DataCVE-2022-45083 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.3.2.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON paramCVE-2024-0405 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and the lack of adequate preparation in SQL queries. As a result, authenticated attackers with editor access or higher can append additional SQL queries into existing ones, potentially leading to unauthorized access to sensitive information from the database.
Fixed in
1.5.3
What to do
Update the plugin to 1.5.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2024EventON Premium WordPress plugin before 4.5.6, EventON: Do not have authorisation in an AJAX actionCVE-2024-0238 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata.
Product
EventON Premium WordPress plugin before 4.5.6, EventON
Fixed in
4.5.6
What to do
Update EventON Premium WordPress plugin before 4.5.6, EventON to 4.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin through 4.5.8, EventON: Do not have authorisation in some AJAX actionsCVE-2024-0237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, moderator, access details etc
Product
EventON WordPress plugin through 4.5.8, EventON
Affected
up to 4.5.8
Fixed in
2.2.7
What to do
Update EventON WordPress plugin through 4.5.8, EventON to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Do not have authorisation in an AJAX actionCVE-2024-0236 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtual events, including any meeting password set (for example for Zoom)
Product
EventON WordPress plugin before 4.5.5, EventON
Fixed in
4.5.5
What to do
Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Do not have authorisation in an AJAX actionCVE-2024-0235 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
Product
EventON WordPress plugin before 4.5.5, EventON
Fixed in
4.5.5
What to do
Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Do not properly sanitise and escape a parameter before outputting it back in pagesCVE-2024-0233 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EventON WordPress plugin before 4.5.5, EventON
Fixed in
4.5.5
What to do
Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Does not sanitize and escape some of its settingsCVE-2023-6005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
EventON WordPress plugin before 4.5.5, EventON
Fixed in
4.5.5
What to do
Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024LearnPress: Does not sanitise and escape user input before outputting it back in the pageCVE-2023-5558 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
LearnPress
Fixed in
4.2.5.5
What to do
Update LearnPress to 4.2.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
WordPress Database Administrator
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (suchCVE-2022-1538 · WordPress plugins & themes · reported by WPScanHigh 7.2
Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed.
Fixed in
1.1.1
What to do
Update the plugin to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-SCVE-2021-24432 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-Site Scripting issue.
Fixed in
1.5.4.7
What to do
Update the plugin to 1.5.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024DeMomentSomTres WordPress Export Posts With Images: Does not check authorization of requests to export the blog dataCVE-2023-5905 · WordPress plugins & themes · reported by WPScanHigh 8.1
The DeMomentSomTres WordPress Export Posts With Images WordPress plugin through 20220825 does not check authorization of requests to export the blog data, allowing any logged in user, such as subscribers to export the contents of the blog, including restricted and unpublished posts, as well as passwords of protected posts.
Product
DeMomentSomTres WordPress Export Posts With Images
Affected
up to 20220825
What to do
Affects up to 20220825. Update DeMomentSomTres WordPress Export Posts With Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 12, 2024WordPress Quiz Maker Plugin prior to 6.5.0.6: Improper input validationCVE-2024-22027 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services.
Product
WordPress Quiz Maker Plugin prior to 6.5.0.6
Fixed in
6.5.0.6
What to do
Update WordPress Quiz Maker Plugin prior to 6.5.0.6 to 6.5.0.6 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 11, 2024EventON - WordPress Virtual Event Calendar: Cross-Site Request ForgeryCVE-2023-6244 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or incorrect nonce validation on the save_virtual_event_settings function. This makes it possible for unauthenticated attackers to modify virtual event settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
EventON - WordPress Virtual Event Calendar
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update EventON - WordPress Virtual Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.myeventon.com plugins.trac.wordpress.org
Jan 11, 2024EventON - WordPress Virtual Event Calendar: Cross-Site Request ForgeryCVE-2023-6242 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_eventpost_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
EventON - WordPress Virtual Event Calendar
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update EventON - WordPress Virtual Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.myeventon.com plugins.trac.wordpress.org
Jan 11, 2024Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder: Stored Cross-Site ScriptingCVE-2023-6828 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ arf_http_referrer_url’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2023-6742 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'envira_gallery_insert_images' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users' posts.
Product
Gallery Plugin for WordPress – Envira Photo Gallery
Affected
up to 1.8.7.1
What to do
Affects up to 1.8.7.1. Update Gallery Plugin for WordPress – Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Ibtana – WordPress Website Builder: Stored Cross-Site ScriptingCVE-2023-6684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ive' shortcode in versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on 'width' and 'height' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ibtana – WordPress Website Builder
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Ibtana – WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024LearnPress: Command InjectionCVE-2023-6634 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution.
Product
LearnPress
Affected
up to 4.2.5.7
What to do
Affects up to 4.2.5.7. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024LearnPress: Time-based SQL InjectionCVE-2023-6567 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LearnPress
Affected
up to 4.2.5.7
What to do
Affects up to 4.2.5.7. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024WP Compress – Image Optimizer [All-In-One]: Directory TraversalCVE-2023-6699 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
WP Compress – Image Optimizer [All-In-One]
Affected
up to 6.10.33
What to do
Affects up to 6.10.33. Update WP Compress – Image Optimizer [All-In-One] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024LearnPress: Insecure Direct Object ReferenceCVE-2023-6223 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of another user's course progress.
Product
LearnPress
Affected
up to 4.2.5.7
What to do
Affects up to 4.2.5.7. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2024EventON - WordPress Virtual Event Calendar: Unauthorized modification of data and loss of dataCVE-2023-6158 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Note that certain parameters may allow for content injection. CVE-2024-0238 appears to be a duplicate of this issue.
Product
EventON - WordPress Virtual Event Calendar
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update EventON - WordPress Virtual Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.myeventon.com plugins.trac.wordpress.org
Jan 8, 2024WordPress Button Plugin MaxButtons: Stored Cross-Site ScriptingCVE-2023-6594 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Administrators can give button creation privileges to users with lower levels (contributor+) which would allow those lower-privileged users to carry out attacks.
Product
WordPress Button Plugin MaxButtons
Affected
up to 9.7.4
What to do
Affects up to 9.7.4. Update WordPress Button Plugin MaxButtons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2024WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51408 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: from n/a through 1.4.3.
Product
WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024FastDup – Fastest WordPress Migration & Duplicator: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51406 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FastDup – Fastest WordPress Migration & Duplicator.This issue affects FastDup – Fastest WordPress Migration & Duplicator: from n/a through 2.1.7.
Product
FastDup – Fastest WordPress Migration & Duplicator
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update FastDup – Fastest WordPress Migration & Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Migrate WordPress Website & Backups: Does not prevent directory listing in sensitive directories containing export filesCVE-2023-6505 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files.
Product
Migrate WordPress Website & Backups
Fixed in
1.9.3
What to do
Update Migrate WordPress Website & Backups to 1.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024WP Custom Cursors | WordPress Cursor: Does not sanitise and escape some of its settingsCVE-2023-5911 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Custom Cursors | WordPress Cursor
Affected
up to 3.2
What to do
Affects up to 3.2. Update WP Custom Cursors | WordPress Cursor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 5, 2024Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: Cross-Site Request Forgery (CSRF)CVE-2023-52119 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.18.
Product
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building
Affected
up to 3.1.18
What to do
Affects up to 3.1.18. Update Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024Inline Image Upload for BBPress: Cross-Site Request Forgery (CSRF)CVE-2023-51668 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Inline Image Upload for BBPress.This issue affects Inline Image Upload for BBPress: from n/a through 1.1.18.
Product
Inline Image Upload for BBPress
Affected
up to 1.1.18
What to do
Affects up to 1.1.18. Update Inline Image Upload for BBPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024Awesome Support – WordPress HelpDesk & Support: Cross-Site Request Forgery (CSRF)CVE-2023-51538 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.5.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024teachPress: Cross-Site Request Forgery (CSRF)CVE-2023-52129 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4.
Product
teachPress
Affected
up to 9.0.4
What to do
Affects up to 9.0.4. Update teachPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: Cross-Site Request Forgery (CSRF)CVE-2023-52128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0.
Product
White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 3, 2024Best WordPress Gallery Plugin – FooGallery: Stored Cross-Site ScriptingCVE-2023-6747 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Best WordPress Gallery Plugin – FooGallery
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Best WordPress Gallery Plugin – FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fooplugins.com plugins.trac.wordpress.org
Jan 3, 2024The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerableCVE-2023-6986 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed_oembed_html shortcode in all versions up to 3.9.5 (exclusive) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Jan 3, 2024WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: SQL InjectionCVE-2023-6981 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id' parameter in all versions up to, and including, 6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can leveraged to achieve Reflected Cross-site Scripting.
Product
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
Affected
up to 6.5
What to do
Affects up to 6.5. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 3, 2024WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: Cross-Site Request ForgeryCVE-2023-6980 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5. This is due to missing or incorrect nonce validation on the 'delete' action of the wp-sms-subscribers page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
Affected
up to 6.5
What to do
Affects up to 6.5. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 3, 2024MapPress Maps for: Stored Cross-Site ScriptingCVE-2023-6524 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all versions up to and including 2.88.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MapPress Maps for
Affected
up to 2.88.13
What to do
Affects up to 2.88.13. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Jan 2, 2024A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic.CVE-2015-10128 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royal_prettyphoto_plugin_links of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3 is able to address this issue. The patch is identified as 0d3d38cfa487481b66869e4212df1cefc281ecb7. It is recommended to upgrade the affected component. VDB-249422 is the identifier assigned to this vulnerability.
Product
rt-prettyphoto
Affected
up to 1.2
What to do
Affects up to 1.2. Update rt-prettyphoto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.