Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

509new WordPress flaws this week

397,455entries in the database

41,339 results · page 454 of 827

Jan 6, 2025WordPress Survey & Poll – Quiz, Survey and Poll Plugin for: Stored Cross-Site ScriptingCVE-2024-12528 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsurveypoll_results' shortcode in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Survey & Poll – Quiz, Survey and Poll Plugin for
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update WordPress Survey & Poll – Quiz, Survey and Poll Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2025The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler: Arbitrary shortcode executionCVE-2024-12419 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This functionality is also vulnerable to Reflected Cross-Site Scripting. Version 1.7.0 patched the Reflected XSS issue, however, the arbitrary shortcode execution issue remains.
Product
The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2025Live Sales Notification for Woocommerce – Woomotiv: SQL InjectionCVE-2024-12416 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to SQL Injection via the 'woomotiv_seen_products_.*' cookie in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Live Sales Notification for Woocommerce – Woomotiv
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update Live Sales Notification for Woocommerce – Woomotiv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 6, 2025Themes Coder – Create Android & iOS Apps For Your Woocommerce Site: Privilege escalationCVE-2024-12402 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's identity prior to updating their password through the update_user_profile() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
Themes Coder – Create Android & iOS Apps For Your Woocommerce Site
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Themes Coder – Create Android & iOS Apps For Your Woocommerce Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2025ARS Affiliate Page: Reflected Cross-Site ScriptingCVE-2024-12098 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utm_keyword' parameter in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ARS Affiliate Page
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update ARS Affiliate Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 6, 2025Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce: Stored Cross-Site ScriptingCVE-2024-11934 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' shortcode in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce
Affected
up to 2.1.3.2
What to do
Affects up to 2.1.3.2. Update Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 6, 2025Slider Pro Lite: Stored Cross-Site ScriptingCVE-2024-11899 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider Pro Lite
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Slider Pro Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2025Sell Media: Stored Cross-Site ScriptingCVE-2024-11777 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sell Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sell_media_search_form_gutenberg' shortcode in all versions up to, and including, 2.5.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sell Media
Affected
up to 2.5.8.5
What to do
Affects up to 2.5.8.5. Update Sell Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 6, 2025Timeline Designer: SQL InjectionCVE-2024-11437 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Timeline Designer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Timeline Designer
Affected
up to 1.4
What to do
Affects up to 1.4. Update Timeline Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2025Email Subscribers by Icegram Express: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12311 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Email Subscribers by Icegram Express
Fixed in
5.7.44
What to do
Update Email Subscribers by Icegram Express to 5.7.44 or newer.
Full record and what to do →NVD record wpscan.com
Jan 6, 2025Icegram Engage: Does not sanitise and escape some of its Campaign settingsCVE-2024-12302 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks
Product
Icegram Engage
Fixed in
3.1.32
What to do
Update Icegram Engage to 3.1.32 or newer.
Full record and what to do →NVD record wpscan.com
Jan 6, 2025Pods: Does not sanitise and escape some of its settingsCVE-2024-11849 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Pods
Fixed in
3.2.8.1
What to do
Update Pods to 3.2.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Jan 6, 2025tourmaster: Does not sanitise and escape some parametersCVE-2024-11356 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
Product
tourmaster
Fixed in
5.3.4
What to do
Update tourmaster to 5.3.4 or newer.
Full record and what to do →NVD record wpscan.com
Jan 4, 2025UpdraftPlus: WP Backup & Migration: PHP Object InjectionCVE-2024-10957 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit.
Product
UpdraftPlus: WP Backup & Migration
What to do
Update UpdraftPlus: WP Backup & Migration to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025WP Multi Store Locator: Stored Cross-Site ScriptingCVE-2024-12475 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Multi Store Locator
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update WP Multi Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 4, 2025WP Social AutoConnect: Cross-Site Request ForgeryCVE-2024-12279 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Social AutoConnect
Affected
up to 4.6.2
What to do
Affects up to 4.6.2. Update WP Social AutoConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 4, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: SQL InjectionCVE-2024-12195 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, who have been granted access to a project, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Affected
up to 2.6.16
What to do
Affects up to 2.6.16. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025Turnkey bbPress by WeaverTheme: Reflected Cross-Site ScriptingCVE-2024-12221 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘_wpnonce’ parameter in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Turnkey bbPress by WeaverTheme
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Turnkey bbPress by WeaverTheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 4, 2025Dynamics 365 Integration: Remote Code Execution and Arbitrary File ReadCVE-2024-12583 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Product
Dynamics 365 Integration
Affected
up to 1.3.23
What to do
Affects up to 1.3.23. Update Dynamics 365 Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025Taskbuilder – WordPress Project & Task Management: Stored Cross-Site ScriptingCVE-2024-11930 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shortcode in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Taskbuilder – WordPress Project & Task Management
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update Taskbuilder – WordPress Project & Task Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025WP Smart Import : Import any XML File to: Reflected Cross-Site ScriptingCVE-2024-12701 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Smart Import : Import any XML File to
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Smart Import : Import any XML File to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more: Cross-Site Request ForgeryCVE-2024-12545 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.1. This is due to missing nonce validation on the reset_installation() function. This makes it possible for unauthenticated attackers to reset the plugin’s installation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025WP Compress – Instant Performance & Speed Optimization: Reflected Cross-Site ScriptingCVE-2024-12047 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Compress – Instant Performance & Speed Optimization
Affected
up to 6.30.03
What to do
Affects up to 6.30.03. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025Media Library Assistant: Reflected Cross-Site ScriptingCVE-2024-11974 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Media Library Assistant
Affected
up to 3.23
What to do
Affects up to 3.23. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025Backup Migration: PHP Object InjectionCVE-2024-10932 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.
Product
Backup Migration
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2025Photo Gallery Slideshow & Masonry Tiled Gallery: Server-Side Request ForgeryCVE-2024-12237 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjg_get_youtube_info_justified_gallery_callback function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to retrieve limited information from internal services.
Product
Photo Gallery Slideshow & Masonry Tiled Gallery
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Photo Gallery Slideshow & Masonry Tiled Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2025The WordPress Popular Posts: Arbitrary shortcode executionCVE-2024-11733 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The WordPress Popular Posts
Affected
up to 7.1.0
What to do
Affects up to 7.1.0. Update The WordPress Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 3, 2025WP Job Portal – A Complete Recruitment System for Company or Job Board website: Insecure Direct Object ReferenceCVE-2024-12132 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create jobs for companies that are unaffiliated with the attacker.
Product
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 2, 2025GiveWP: Missing AuthorizationCVE-2023-23672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.
Product
GiveWP
Affected
up to 2.25.1
What to do
Affects up to 2.25.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WP Table Manager: Missing AuthorizationCVE-2022-47601 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in JoomUnited WP Table Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Table Manager: from n/a through 3.5.2.
Product
WP Table Manager
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update WP Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Post Teaser: Missing AuthorizationCVE-2022-45811 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WeyHan Ng Post Teaser.This issue affects Post Teaser: from n/a through 4.1.5.
Product
Post Teaser
Affected
up to 4.1.5
What to do
Affects up to 4.1.5. Update Post Teaser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025JetEngine: Missing AuthorizationCVE-2023-48758 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.2.4.
Product
JetEngine
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Porto Theme - Functionality: Missing AuthorizationCVE-2023-48739 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Porto Theme Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 2.12.1.
Product
Porto Theme - Functionality
What to do
Update Porto Theme - Functionality to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 2, 202510WebAnalytics: Missing AuthorizationCVE-2023-47807 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10WebAnalytics: from n/a through <= 1.2.12.
Product
10WebAnalytics
Affected
up to 1.2.12
What to do
Affects up to 1.2.12. Update 10WebAnalytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025LuckyWP Scripts Control: Missing AuthorizationCVE-2023-47778 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control luckywp-scripts-control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through <= 1.2.1.
Product
LuckyWP Scripts Control
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update LuckyWP Scripts Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025IMPress Listings: Missing AuthorizationCVE-2023-45633 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in IDX IMPress Listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IMPress Listings: from n/a through 2.6.2.
Product
IMPress Listings
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update IMPress Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 202510Web Map Builder for Google Maps: Missing AuthorizationCVE-2023-45272 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.73.
Product
10Web Map Builder for Google Maps
Affected
up to 1.0.73
What to do
Affects up to 1.0.73. Update 10Web Map Builder for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Putler Connector for WooCommerce: Missing AuthorizationCVE-2023-40327 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Putler / Storeapps Putler Connector for WooCommerce.This issue affects Putler Connector for WooCommerce: from n/a through 2.12.0.
Product
Putler Connector for WooCommerce
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update Putler Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025ARMember Premium: Missing AuthorizationCVE-2023-39994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repute InfoSystems ARMember Premium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember Premium: from n/a through 5.9.2.
Product
ARMember Premium
Affected
up to 5.9.2
What to do
Affects up to 5.9.2. Update ARMember Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WoodMart: Missing AuthorizationCVE-2023-32240 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Xtemos WoodMart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WoodMart: from n/a through 7.2.1.
Product
WoodMart
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Analytify: Missing AuthorizationCVE-2022-45830 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Analytify.This issue affects Analytify: from n/a through 4.2.3.
Product
Analytify
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Subscribe to Category: Missing AuthorizationCVE-2022-43476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe to Category: from n/a through 2.7.4.
Product
Subscribe to Category
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update Subscribe to Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Gallery Images Ape: Missing AuthorizationCVE-2022-41995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Galleryape Gallery Images Ape allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gallery Images Ape: from n/a through 2.2.8.
Product
Gallery Images Ape
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Gallery Images Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Patricia Blog: Cross-Site Request Forgery (CSRF)CVE-2024-38732 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Blog allows Cross Site Request Forgery.This issue affects Patricia Blog: from n/a through 1.2.
Product
Patricia Blog
Affected
up to 1.2
What to do
Affects up to 1.2. Update Patricia Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025i-amaze: Cross-Site Request Forgery (CSRF)CVE-2024-38731 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marsian i-amaze allows Cross Site Request Forgery.This issue affects i-amaze: from n/a through 1.3.7.
Product
i-amaze
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update i-amaze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Point: Cross-Site Request Forgery (CSRF)CVE-2024-37931 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Creativthemes Point allows Cross Site Request Forgery.This issue affects Point: from n/a through 1.1.
Product
Point
Affected
up to 1.1
What to do
Affects up to 1.1. Update Point to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025BuddyBoss: Cross-Site Request Forgery (CSRF)CVE-2024-37925 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in BUDDYBOSS LLC BuddyBoss Theme allows Cross Site Request Forgery.This issue affects BuddyBoss Theme: from n/a through 2.4.61.
Product
BuddyBoss
Affected
up to 2.4.61
What to do
Affects up to 2.4.61. Update BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Schema Lite: Cross-Site Request Forgery (CSRF)CVE-2024-37452 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop Schema Lite allows Cross Site Request Forgery.This issue affects Schema Lite: from n/a through 1.2.2.
Product
Schema Lite
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Schema Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Uncanny Toolkit Pro for LearnDash: Cross-Site Request Forgery (CSRF)CVE-2024-37438 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Cross Site Request Forgery.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.
Product
Uncanny Toolkit Pro for LearnDash
Fixed in
4.1.4.1
What to do
Update Uncanny Toolkit Pro for LearnDash to 4.1.4.1 or newer.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025WP Job Manager - Resume Manager: Cross-Site Request Forgery (CSRF)CVE-2024-37241 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager - Resume Manager allows Cross Site Request Forgery.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.
Product
WP Job Manager - Resume Manager
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Job Manager - Resume Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.