Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,417 results · page 465 of 829
Dec 16, 2024SV100 Companion: Incorrect Privilege AssignmentCVE-2024-54229 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Companion: from n/a through <= 2.0.02.
- Product
- SV100 Companion
- Affected
- up to 2.0.02
- What to do
- Affects up to 2.0.02. Update SV100 Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Woffice: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-43234 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: from n/a through <= 5.4.14.
- Product
- Woffice
- Affected
- up to 5.4.14
- What to do
- Affects up to 5.4.14. Update Woffice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Tidy Up: Cross-Site Request Forgery (CSRF)CVE-2024-56015 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in John Godley Tidy Up allows Reflected XSS.This issue affects Tidy Up: from n/a through 1.3.
- Product
- Tidy Up
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Tidy Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Wovax IDX: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-56013 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in wovax Wovax IDX wovax-idx allows Authentication Bypass.This issue affects Wovax IDX: from n/a through <= 1.2.2.
- Product
- Wovax IDX
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Wovax IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Flash News / Post (Responsive): Cross-Site Request Forgery (CSRF)CVE-2024-56012 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Flash News / Post (Responsive) flashnews-fading-effect-pearlbells allows Privilege Escalation.This issue affects Flash News / Post (Responsive): from n/a through <= 4.1.
- Product
- Flash News / Post (Responsive)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Flash News / Post (Responsive) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Responsive Google Maps | by imbaa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56011 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilja Zaglov Responsive Google Maps | by imbaa responsive-google-maps allows Stored XSS.This issue affects Responsive Google Maps | by imbaa: from n/a through <= 1.2.5.
- Product
- Responsive Google Maps | by imbaa
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Responsive Google Maps | by imbaa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Spreadr Woocommerce: Missing AuthorizationCVE-2024-56009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Spreadr Woocommerce: from n/a through <= 1.0.4.
- Product
- Spreadr Woocommerce
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Spreadr Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Leader: Missing AuthorizationCVE-2024-56007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in leader codes Leader leader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leader: from n/a through <= 2.6.1.
- Product
- Leader
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Leader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Posti Shipping: Cross-Site Request Forgery (CSRF)CVE-2024-56005 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Posti Posti Shipping posti-shipping allows Cross Site Request Forgery.This issue affects Posti Shipping: from n/a through <= 3.10.3.
- Product
- Posti Shipping
- Affected
- up to 3.10.3
- What to do
- Affects up to 3.10.3. Update Posti Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Easy Site Importer: Missing AuthorizationCVE-2024-56004 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in awfowler Easy Site Importer easy-site-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Site Importer: from n/a through <= 1.0.1.
- Product
- Easy Site Importer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Easy Site Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Ksher: Missing AuthorizationCVE-2024-56001 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ksher: from n/a through <= 1.1.1.
- Product
- Ksher
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Ksher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Popup Surveys & Polls for WordPress (Mare.io): Missing AuthorizationCVE-2024-55998 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) popup-surveys allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Surveys & Polls for WordPress (Mare.io): from n/a through <= 1.36.
- Product
- Popup Surveys & Polls for WordPress (Mare.io)
- Affected
- up to 1.36
- What to do
- Affects up to 1.36. Update Popup Surveys & Polls for WordPress (Mare.io) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Dreamfox Media Payment gateway per Product for Woocommerce: Missing AuthorizationCVE-2024-55996 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dreamfox Media Payment gateway per Product for Woocommerce: from n/a through <= 3.5.6.
- Product
- Dreamfox Media Payment gateway per Product for Woocommerce
- Affected
- up to 3.5.6
- What to do
- Affects up to 3.5.6. Update Dreamfox Media Payment gateway per Product for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024畅言评论系统: Missing AuthorizationCVE-2024-55994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sohu 畅言评论系统 changyan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 畅言评论系统: from n/a through <= 2.0.5.
- Product
- 畅言评论系统
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update 畅言评论系统 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Job Board Manager: Missing AuthorizationCVE-2024-55993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- Product
- Job Board Manager
- Affected
- up to 2.1.61
- What to do
- Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WooCommerce Basic Ordernumbers: Missing AuthorizationCVE-2024-55992 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Open Tools WooCommerce Basic Ordernumbers woocommerce-basic-ordernumbers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Basic Ordernumbers: from n/a through <= 1.4.4.
- Product
- WooCommerce Basic Ordernumbers
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update WooCommerce Basic Ordernumbers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Mollie for Contact Form 7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55990 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tsjippy Mollie for Contact Form 7 cf7-mollie allows Blind SQL Injection.This issue affects Mollie for Contact Form 7: from n/a through <= 5.0.0.
- Product
- Mollie for Contact Form 7
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Mollie for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP Simple Pay Lite Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55989 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kyle M Brown WP Simple Pay Lite Manager stripe-manager allows SQL Injection.This issue affects WP Simple Pay Lite Manager: from n/a through <= 1.4.
- Product
- WP Simple Pay Lite Manager
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WP Simple Pay Lite Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Navayan CSV Export: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55988 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export navayan-csv-export allows Blind SQL Injection.This issue affects Navayan CSV Export: from n/a through <= 1.0.9.
- Product
- Navayan CSV Export
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Navayan CSV Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Advanced What should we write next about: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55987 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows SQL Injection.This issue affects Advanced What should we write next about: from n/a through <= 1.0.3.
- Product
- Advanced What should we write next about
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Advanced What should we write next about to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Service: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55986 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tiny13 Service service allows Blind SQL Injection.This issue affects Service: from n/a through <= 1.0.4.
- Product
- Service
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Share Buttons – Social Media: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55982 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.
- Product
- Share Buttons – Social Media
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Share Buttons – Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Nabz Image Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55981 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.
- Product
- Nabz Image Gallery
- Affected
- up to 1.00
- What to do
- Affects up to 1.00. Update Nabz Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55980 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.
- Product
- Wr Age Verification
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55979 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.
- Product
- Wr Age Verification
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Code Generator Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55978 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WalletStation Code Generator Pro code-generator-pro allows SQL Injection.This issue affects Code Generator Pro: from n/a through <= 1.2.
- Product
- Code Generator Pro
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Code Generator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024LaunchPage.app Importer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55977 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BinaryCarpenter LaunchPage.app Importer launchpage-app-importer allows SQL Injection.This issue affects LaunchPage.app Importer: from n/a through <= 1.1.
- Product
- LaunchPage.app Importer
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update LaunchPage.app Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Critical Site Intel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55976 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mikeleembruggen Critical Site Intel critical-site-intel-stats allows SQL Injection.This issue affects Critical Site Intel: from n/a through <= 1.0.
- Product
- Critical Site Intel
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Critical Site Intel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Mimoos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55974 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martí Batlles Martinez Mimoos devoluciones-packback allows SQL Injection.This issue affects Mimoos: from n/a through <= 1.2.
- Product
- Mimoos
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Mimoos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024TSB Occasion Editor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55973 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rnystrom TSB Occasion Editor tsb-occasion-editor allows SQL Injection.This issue affects TSB Occasion Editor: from n/a through <= 1.2.1.
- Product
- TSB Occasion Editor
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update TSB Occasion Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024eTemplates: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55972 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.
- Product
- eTemplates
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update eTemplates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Advanced Data Table For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54443 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Advanced Data Table For Elementor advanced-data-table-for-elementor allows Stored XSS.This issue affects Advanced Data Table For Elementor: from n/a through <= 1.0.0.
- Product
- Advanced Data Table For Elementor
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Advanced Data Table For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Better WP Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54442 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cortesfrau Better WP Login Page better-wp-login-page allows Stored XSS.This issue affects Better WP Login Page: from n/a through <= 1.1.2.
- Product
- Better WP Login Page
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Better WP Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Utech World Time: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54441 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time utech-world-time-for-wp allows Stored XSS.This issue affects Utech World Time: from n/a through <= 1.0.
- Product
- Utech World Time
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Utech World Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP-Ban-User: Cross-Site Request Forgery (CSRF)CVE-2024-54440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n/a through <= 1.0.
- Product
- WP-Ban-User
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP-Ban-User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Amazon Product Price: Cross-Site Request Forgery (CSRF)CVE-2024-54439 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Price: from n/a through <= 1.1.
- Product
- Amazon Product Price
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Amazon Product Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Gaxx Keywords: Cross-Site Request Forgery (CSRF)CVE-2024-54438 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in gaxx Gaxx Keywords gaxx-keywords allows Stored XSS.This issue affects Gaxx Keywords: from n/a through <= 0.2.
- Product
- Gaxx Keywords
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Gaxx Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024jCarousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in koolkatwebdesigns jCarousel jcarousel-for-wordpress allows Stored XSS.This issue affects jCarousel: from n/a through <= 1.0.
- Product
- jCarousel
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update jCarousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Jet Footer Code: Cross-Site Request Forgery (CSRF)CVE-2024-54436 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in milordk Jet Footer Code jet-footer-code allows Stored XSS.This issue affects Jet Footer Code: from n/a through <= 1.4.
- Product
- Jet Footer Code
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Jet Footer Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Onlywire Multi Autosubmitter: Cross-Site Request Forgery (CSRF)CVE-2024-54435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Thomas Hoefter Onlywire Multi Autosubmitter onlywire-multi-autosubmitter allows Stored XSS.This issue affects Onlywire Multi Autosubmitter: from n/a through <= 1.2.4.
- Product
- Onlywire Multi Autosubmitter
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Onlywire Multi Autosubmitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024phZoom: Cross-Site Request Forgery (CSRF)CVE-2024-54434 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through <= 1.2.92.
- Product
- phZoom
- Affected
- up to 1.2.92
- What to do
- Affects up to 1.2.92. Update phZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Simple Booking Widget: Cross-Site Request Forgery (CSRF)CVE-2024-54433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Marcel CL Simple Booking Widget simple-booking-widget allows Stored XSS.This issue affects Simple Booking Widget: from n/a through <= 1.1.
- Product
- Simple Booking Widget
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple Booking Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP Flipkart Importer: Cross-Site Request Forgery (CSRF)CVE-2024-54432 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik WP Flipkart Importer wp-flipkart-importer allows Stored XSS.This issue affects WP Flipkart Importer: from n/a through <= 1.4.
- Product
- WP Flipkart Importer
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WP Flipkart Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Admin Customization: Cross-Site Request Forgery (CSRF)CVE-2024-54431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in phpdevp Admin Customization wpp-customization allows Stored XSS.This issue affects Admin Customization: from n/a through <= 2.2.
- Product
- Admin Customization
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Admin Customization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024EELV Newsletter: Cross-Site Request Forgery (CSRF)CVE-2024-54430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Cross Site Request Forgery.This issue affects EELV Newsletter: from n/a through <= 4.8.2.
- Product
- EELV Newsletter
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update EELV Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Aphorismus: Cross-Site Request Forgery (CSRF)CVE-2024-54429 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ivan-ovsyannikov Aphorismus aphorismus allows Stored XSS.This issue affects Aphorismus: from n/a through <= 1.2.0.
- Product
- Aphorismus
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Aphorismus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Add image to Post: Cross-Site Request Forgery (CSRF)CVE-2024-54428 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in onigetoc Add image to Post add-image-to-post allows Stored XSS.This issue affects Add image to Post: from n/a through <= 0.6.
- Product
- Add image to Post
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update Add image to Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Category of Posts: Cross-Site Request Forgery (CSRF)CVE-2024-54427 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ljmacphee Category of Posts list-one-category-of-posts allows Stored XSS.This issue affects Category of Posts: from n/a through <= 1.0.
- Product
- Category of Posts
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Category of Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024LeaderBoard: Cross-Site Request Forgery (CSRF)CVE-2024-54426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in crossfitatgg LeaderBoard Plugin leaderboard-lite allows Stored XSS.This issue affects LeaderBoard Plugin: from n/a through <= 1.2.4.
- Product
- LeaderBoard
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update LeaderBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024LionScripts: Site Maintenance & Noindex Nofollow: Cross-Site Request Forgery (CSRF)CVE-2024-54425 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.com LionScripts: Site Maintenance & Noindex Nofollow Plugin maintenance-and-noindex-nofollow allows Stored XSS.This issue affects LionScripts: Site Maintenance & Noindex Nofollow Plugin: from n/a through <= 2.1.
- Product
- LionScripts: Site Maintenance & Noindex Nofollow
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update LionScripts: Site Maintenance & Noindex Nofollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.