Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,339 results · page 451 of 827
Jan 7, 2025Image Hover Effects for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22323 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Image Hover Effects for Elementor image-hover-effects-elementor-addon allows Stored XSS.This issue affects Image Hover Effects for Elementor: from n/a through <= 1.0.2.4.
- Product
- Image Hover Effects for Elementor
- Affected
- up to 1.0.2.4
- What to do
- Affects up to 1.0.2.4. Update Image Hover Effects for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025ElementsCSS Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22321 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs ElementsCSS Addons for Elementor css-for-elementor allows Stored XSS.This issue affects ElementsCSS Addons for Elementor: from n/a through <= 1.0.8.9.
- Product
- ElementsCSS Addons for Elementor
- Affected
- up to 1.0.8.9
- What to do
- Affects up to 1.0.8.9. Update ElementsCSS Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025ProductDyno: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22320 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProductDyno ProductDyno productdyno allows Reflected XSS.This issue affects ProductDyno: from n/a through <= 1.0.24.
- Product
- ProductDyno
- Affected
- up to 1.0.24
- What to do
- Affects up to 1.0.24. Update ProductDyno to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPBITS Addons For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22316 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.5.1.
- Product
- WPBITS Addons For Elementor Page Builder
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update WPBITS Addons For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Typing Text: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22315 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Typing Text typing-text allows Stored XSS.This issue affects Typing Text: from n/a through <= 1.2.7.
- Product
- Typing Text
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Typing Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Thim Elementor Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22312 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows DOM-Based XSS.This issue affects Thim Elementor Kit: from n/a through <= 1.2.9.
- Product
- Thim Elementor Kit
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Thim Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025TemplatesNext ToolKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marsian TemplatesNext ToolKit templatesnext-toolkit allows Stored XSS.This issue affects TemplatesNext ToolKit: from n/a through <= 3.2.9.
- Product
- TemplatesNext ToolKit
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update TemplatesNext ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025SpeakOut! Email Petitions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22309 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RopeSwingHld SpeakOut! Email Petitions speakout allows DOM-Based XSS.This issue affects SpeakOut! Email Petitions: from n/a through <= 4.4.2.
- Product
- SpeakOut! Email Petitions
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update SpeakOut! Email Petitions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Smart Custom Fields: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22308 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Kitajima Smart Custom Fields smart-custom-fields allows Stored XSS.This issue affects Smart Custom Fields: from n/a through <= 5.0.0.
- Product
- Smart Custom Fields
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Smart Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Hero Banner Ultimate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22305 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Essential Plugin Hero Banner Ultimate hero-banner-ultimate allows PHP Local File Inclusion.This issue affects Hero Banner Ultimate: from n/a through <= 1.4.4.
- Product
- Hero Banner Ultimate
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Hero Banner Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Visitor Statistics (Real Time Traffic): Missing AuthorizationCVE-2025-22304 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.5.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 7.5
- What to do
- Affects up to 7.5. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Mailster: Insertion of Sensitive Information Into Sent DataCVE-2025-22303 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
- Product
- WP Mailster
- Affected
- up to 1.8.17.0
- What to do
- Affects up to 1.8.17.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Wand: Missing AuthorizationCVE-2025-22302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.2.5.
- Product
- WP Wand
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update WP Wand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025MyBookTable Bookstore: Cross-Site Request Forgery (CSRF)CVE-2025-22301 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in zookatron MyBookTable Bookstore mybooktable allows Cross Site Request Forgery.This issue affects MyBookTable Bookstore: from n/a through <= 3.5.3.
- Product
- MyBookTable Bookstore
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update MyBookTable Bookstore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025PixelYourSite – Your smart PIXEL (TAG) Manager: Cross-Site Request Forgery (CSRF)CVE-2025-22300 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Cross Site Request Forgery.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 10.0.1.2.
- Product
- PixelYourSite – Your smart PIXEL (TAG) Manager
- Affected
- up to 10.0.1.2
- What to do
- Affects up to 10.0.1.2. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025AI for SEO: Missing AuthorizationCVE-2025-22299 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Space Codes AI for SEO ai-for-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI for SEO: from n/a through <= 1.2.9.
- Product
- AI for SEO
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update AI for SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Hive Support: Missing AuthorizationCVE-2025-22298 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hive Support: from n/a through <= 1.1.6.
- Product
- Hive Support
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025AI WP Writer: Cross-Site Request Forgery (CSRF)CVE-2025-22297 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in aipost AI WP Writer ai-wp-writer allows Cross Site Request Forgery.This issue affects AI WP Writer: from n/a through <= 3.8.4.4.
- Product
- AI WP Writer
- Affected
- up to 3.8.4.4
- What to do
- Affects up to 3.8.4.4. Update AI WP Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Gutentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22293 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gutentor Gutentor gutentor allows DOM-Based XSS.This issue affects Gutentor: from n/a through <= 3.4.3.
- Product
- Gutentor
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Gutentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP FullCalendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22261 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Stored XSS.This issue affects WP FullCalendar: from n/a through <= 1.5.
- Product
- WP FullCalendar
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WP FullCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Post/Page Copying Tool: Insertion of Sensitive Information Into Sent DataCVE-2024-56300 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Retrieve Embedded Sensitive Data.This issue affects Post/Page Copying Tool: from n/a through <= 2.0.0.
- Product
- Post/Page Copying Tool
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Post/Page Copying Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Notify Odoo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56299 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pektsekye Notify Odoo notify-odoo allows Stored XSS.This issue affects Notify Odoo: from n/a through <= 1.0.0.
- Product
- Notify Odoo
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Notify Odoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Pretty Simple Popup Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56298 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob @ 5 Star Plugins Pretty Simple Popup Builder pretty-simple-popup-builder allows Stored XSS.This issue affects Pretty Simple Popup Builder: from n/a through <= 1.0.9.
- Product
- Pretty Simple Popup Builder
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Pretty Simple Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Highlight: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56297 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Highlight highlight allows Stored XSS.This issue affects Highlight: from n/a through <= 2.0.2.
- Product
- Highlight
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Highlight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Mang Board WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56296 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Reflected XSS.This issue affects Mang Board WP: from n/a through <= 1.8.4.
- Product
- Mang Board WP
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Nexter Blocks: Missing AuthorizationCVE-2024-56294 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nexter Blocks: from n/a through <= 4.0.7.
- Product
- Nexter Blocks
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Advanced Form Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56293 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Stored XSS.This issue affects Advanced Form Integration: from n/a through <= 1.95.0.
- Product
- Advanced Form Integration
- Affected
- up to 1.95.0
- What to do
- Affects up to 1.95.0. Update Advanced Form Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Email Reminders: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56292 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Email Reminders email-reminders allows Stored XSS.This issue affects Email Reminders: from n/a through <= 2.0.5.
- Product
- Email Reminders
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Email Reminders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025PlainInventory: Deserialization of Untrusted DataCVE-2024-56291 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.
- Product
- PlainInventory
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update PlainInventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Multiple Shipping And Billing Address For Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56290 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows SQL Injection.This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through <= 1.2.
- Product
- Multiple Shipping And Billing Address For Woocommerce
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Multiple Shipping And Billing Address For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Groundhogg: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey Groundhogg groundhogg allows Reflected XSS.This issue affects Groundhogg: from n/a through <= 3.7.3.3.
- Product
- Groundhogg
- Affected
- up to 3.7.3.3
- What to do
- Affects up to 3.7.3.3. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Docs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56288 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs wp-docs allows Stored XSS.This issue affects WP Docs: from n/a through <= 2.2.1.
- Product
- WP Docs
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP jQuery DataTable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56287 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty WP jQuery DataTable wp-jquery-datatable allows Stored XSS.This issue affects WP jQuery DataTable: from n/a through <= 4.0.1.
- Product
- WP jQuery DataTable
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update WP jQuery DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Classic Addons – WPBakery Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-56286 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows PHP Local File Inclusion.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.0.
- Product
- Classic Addons – WPBakery Page Builder
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Classic Addons – WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPBITS Addons For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56285 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.5.1.
- Product
- WPBITS Addons For Elementor Page Builder
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update WPBITS Addons For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025SSL Wireless SMS Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56284 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows SQL Injection.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.5.0.
- Product
- SSL Wireless SMS Notification
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update SSL Wireless SMS Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Locatoraid Store Locator: Deserialization of Untrusted DataCVE-2024-56283 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.50.
- Product
- Locatoraid Store Locator
- Affected
- up to 3.9.50
- What to do
- Affects up to 3.9.50. Update Locatoraid Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPMozo Addons Lite for Elementor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-56282 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lite-for-elementor allows PHP Local File Inclusion.This issue affects WPMozo Addons Lite for Elementor: from n/a through <= 1.1.0.
- Product
- WPMozo Addons Lite for Elementor
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WPMozo Addons Lite for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025워드프레스 결제 심플페이: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-56281 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows PHP Local File Inclusion.This issue affects 워드프레스 결제 심플페이: from n/a through <= 5.2.0.
- Product
- 워드프레스 결제 심플페이
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update 워드프레스 결제 심플페이 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPGuppy: Incorrect Privilege AssignmentCVE-2024-56280 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Privilege Escalation.This issue affects WPGuppy: from n/a through <= 1.1.0.
- Product
- WPGuppy
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Compact WP Audio Player: Server-Side Request Forgery (SSRF)CVE-2024-56279 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in mra13 Compact WP Audio Player compact-wp-audio-player allows Server Side Request Forgery.This issue affects Compact WP Audio Player: from n/a through <= 1.9.14.
- Product
- Compact WP Audio Player
- Affected
- up to 1.9.14
- What to do
- Affects up to 1.9.14. Update Compact WP Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Ultimate Exporter: Improper Control of Generation of Code ('Code Injection')CVE-2024-56278 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows PHP Remote File Inclusion.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.1.
- Product
- WP Ultimate Exporter
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update WP Ultimate Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Contact Form by WPForms: Missing AuthorizationCVE-2024-56276 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.
- Product
- Contact Form by WPForms
- Affected
- up to 1.9.2.2
- What to do
- Affects up to 1.9.2.2. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Envato Elements: Server-Side Request Forgery (SSRF)CVE-2024-56275 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Server-Side Request Forgery (SSRF) vulnerability in Envato Envato Elements allows Server Side Request Forgery.This issue affects Envato Elements: from n/a through 2.0.14.
- Product
- Envato Elements
- Affected
- up to 2.0.14
- What to do
- Affects up to 2.0.14. Update Envato Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Astra Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56274 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through <= 1.2.15.
- Product
- Astra Widgets
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update Astra Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPvivid Backup and Migration: Missing AuthorizationCVE-2024-56273 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migration wpvivid-backuprestore allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPvivid Backup and Migration: from n/a through <= 0.9.106.
- Product
- WPvivid Backup and Migration
- Affected
- up to 0.9.106
- What to do
- Affects up to 0.9.106. Update WPvivid Backup and Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP SecureSubmit: Missing AuthorizationCVE-2024-56271 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SecureSubmit: from n/a through <= 1.5.20.
- Product
- WP SecureSubmit
- Affected
- up to 1.5.20
- What to do
- Affects up to 1.5.20. Update WP SecureSubmit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025ClickWhale: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51715 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickWhale ClickWhale clickwhale allows Blind SQL Injection.This issue affects ClickWhale: from n/a through <= 2.4.1.
- Product
- ClickWhale
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025NAVER Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eutrue NAVER Analytics naver-analytics allows Stored XSS.This issue affects NAVER Analytics: from n/a through <= 0.9.
- Product
- NAVER Analytics
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update NAVER Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025CubeWP Forms: Missing AuthorizationCVE-2024-51651 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.10.
- Product
- CubeWP Forms
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.