Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

5,864 results · page 47 of 118

Dec 7, 2023Starter Templates — Elementor, WordPress & Beaver Builder Templates: Server-Side Request Forgery (SSRF)CVE-2023-41804 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4.
Product
Starter Templates — Elementor, WordPress & Beaver Builder Templates
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Starter Templates — Elementor, WordPress & Beaver Builder Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/myCVE-2023-6360 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.6
The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.
Fixed in
3.4.22
What to do
Update the plugin to 3.4.22 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Nov 30, 2023WordPress Gallery Plugin – NextGEN Gallery: Cross-Site Request Forgery (CSRF)CVE-2023-48328 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery allows Cross Site Request Forgery.This issue affects WordPress Gallery Plugin – NextGEN Gallery: from n/a through 3.37.
Product
WordPress Gallery Plugin – NextGEN Gallery
Affected
up to 3.37
What to do
Affects up to 3.37. Update WordPress Gallery Plugin – NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023affiliate-toolkit – WordPress Affiliate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-46086 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin allows Reflected XSS.This issue affects affiliate-toolkit – WordPress Affiliate Plugin: from n/a through 3.4.3.
Product
affiliate-toolkit – WordPress Affiliate
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update affiliate-toolkit – WordPress Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023KB Support – WordPress Help Desk and Knowledge Base: Missing AuthorizationCVE-2023-37890 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.5.88
What to do
Affects up to 1.5.88. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.64.
Product
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
Affected
up to 1.0.64
What to do
Affects up to 1.0.64. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44150 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.13.2.
Product
Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.13.2
What to do
Affects up to 4.13.2. Update Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Awesome Support – WordPress HelpDesk & Support: Cross-Site Request Forgery (CSRF)CVE-2023-48323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross Site Request Forgery.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.4.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.1.4
What to do
Affects up to 6.1.4. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023eDoc Employee Job Application – Best WordPress Job Manager for Employees: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Application – Best WordPress Job Manager for Employees allows Reflected XSS.This issue affects eDoc Employee Job Application – Best WordPress Job Manager for Employees: from n/a through 1.13.
Product
eDoc Employee Job Application – Best WordPress Job Manager for Employees
Affected
up to 1.13
What to do
Affects up to 1.13. Update eDoc Employee Job Application – Best WordPress Job Manager for Employees to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023BookingPress: Arbitrary file uploadsCVE-2023-6219 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpress_process_upload' function in versions up to, and including, 1.0.76. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
BookingPress
Affected
up to 1.0.76
What to do
Affects up to 1.0.76. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2023The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tagsCVE-2023-5845 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tags
Product
Simple Social Media Share Buttons
Fixed in
5.1.1
What to do
Update Simple Social Media Share Buttons to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WordPress Backup & Migration: Does not sanitise and escape some parametersCVE-2023-5738 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
Product
WordPress Backup & Migration
Fixed in
1.4.4
What to do
Update WordPress Backup & Migration to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WordPress Backup & Migration: Does not authorize some AJAX requestsCVE-2023-5737 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.
Product
WordPress Backup & Migration
Fixed in
1.4.4
What to do
Update WordPress Backup & Migration to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSSCVE-2023-5325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS
Product
Woocommerce Vietnam Checkout
Fixed in
2.0.6
What to do
Update Woocommerce Vietnam Checkout to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WordPress Online Booking and Scheduling: Does not sanitise and escape some of its settingsCVE-2023-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WordPress Online Booking and Scheduling
Fixed in
22.5
What to do
Update WordPress Online Booking and Scheduling to 22.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress pCVE-2023-47839 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.26 versions.
Affected
up to 3.3.26
What to do
Affects up to 3.3.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugiCVE-2023-47835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.2.32 versions.
Affected
up to 1.2.32
What to do
Affects up to 1.2.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versioCVE-2023-47834 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.
Affected
up to 8.1.13
What to do
Affects up to 8.1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress plugin <= 0.18.3 versiCVE-2023-47833 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress plugin <= 0.18.3 versions.
Affected
up to 0.18.3
What to do
Affects up to 0.18.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: CSS InjectionCVE-2023-6164 · WordPress plugins & themes · reported by WordfenceLow 2.2
The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary CSS values into the site tags.
Product
MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Affected
up to 4.5.1.2
What to do
Affects up to 4.5.1.2. Update MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023LifterLMS – WordPress LMS Plugin for eLearning: Directory TraversalCVE-2023-6160 · WordPress plugins & themes · reported by WordfenceLow 3.3
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. This makes it possible for authenticated attackers, with administrator or LMS manager access and above, to read the contents of arbitrary CSV files on the server, which can contain sensitive information as well as removing those files from the server.
Product
LifterLMS – WordPress LMS Plugin for eLearning
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update LifterLMS – WordPress LMS Plugin for eLearning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WCVE-2023-5815 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes it possible for unauthenticated attackers to include arbitrary PHP files and achieve remote code execution. On vulnerable Docker configurations it may be possible for an attacker to create a PHP file and then subsequently include it to achieve RCE.
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions.CVE-2023-26532 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions.
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 20, 2023The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauCVE-2023-5640 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection vulnerability.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record devl00p.github.io wpscan.com
Nov 20, 2023The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_CVE-2023-48300 · WordPress plugins & themes · reported by GitHubMedium 6.3
The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 1.8.1 contains a patch for this issue.
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record d.pr github.com
Nov 18, 2023WordPress Tooltips: Cross-Site Request Forgery (CSRF)CVE-2023-25985 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tomas | Docs | FAQ | Premium Support WordPress Tooltips.This issue affects WordPress Tooltips: from n/a through 8.2.5.
Product
WordPress Tooltips
Affected
up to 8.2.5
What to do
Affects up to 8.2.5. Update WordPress Tooltips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2023AppPresser: Unauthorized password resetsCVE-2023-4214 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
Product
AppPresser
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update AppPresser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2023PowerPress Podcasting plugin by Blubrry: Server-Side Request Forgery (SSRF)CVE-2023-41239 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry: from n/a through 11.0.6.
Product
PowerPress Podcasting plugin by Blubrry
Affected
up to 11.0.6
What to do
Affects up to 11.0.6. Update PowerPress Podcasting plugin by Blubrry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Poll Maker – Best WordPress Poll: Server-Side Request Forgery (SSRF)CVE-2023-34013 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – Best WordPress Poll Plugin: from n/a through 4.6.2.
Product
Poll Maker – Best WordPress Poll
Affected
up to 4.6.2
What to do
Affects up to 4.6.2. Update Poll Maker – Best WordPress Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.CVE-2023-47230 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.6.0 versions.
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versionCVE-2023-26524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.10 versions.
Affected
up to 8.0.10
What to do
Affects up to 8.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions.CVE-2023-26518 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions.
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023flippercode WordPress Plugin for Google Maps – WP MAPS: Cross-Site Request Forgery (CSRF)CVE-2023-28172 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) plugin <= 4.4.2 versions.
Product
flippercode WordPress Plugin for Google Maps – WP MAPS
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update flippercode WordPress Plugin for Google Maps – WP MAPS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Wbcom Designs Wbcom Designs – BuddyPress Activity Social Share plugin <= 3.5.0 versions.CVE-2023-28694 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Wbcom Designs Wbcom Designs – BuddyPress Activity Social Share plugin <= 3.5.0 versions.
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions.CVE-2023-28498 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions.
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions.CVE-2023-29440 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions.
Affected
up to 2.10.3
What to do
Affects up to 2.10.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.CVE-2023-29428 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.CVE-2023-34031 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.CVE-2023-32739 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.
Fixed in
3.2
What to do
Update the plugin to 3.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions.CVE-2023-47238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions.
Fixed in
3.3.3
What to do
Update the plugin to 3.3.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023UpdraftPlus: WordPress Backup & Migration: Cross-Site Request ForgeryCVE-2023-5982 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information.
Product
UpdraftPlus: WordPress Backup & Migration
Affected
up to 1.23.10
What to do
Affects up to 1.23.10. Update UpdraftPlus: WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2023Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-41798 · WordPress plugins & themes · reported by PatchstackMedium 5.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.
Product
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Email Templates Customizer and Designer for WordPress and WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2022-47181 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.
Product
Email Templates Customizer and Designer for WordPress and WooCommerce
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Email Templates Customizer and Designer for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45810 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2.
Product
Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce
Affected
up to 5.5.2
What to do
Affects up to 5.5.2. Update Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
Product
WordPress Comments Import & Export
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Gift Up Gift Cards for WordPress and WooCommerce: Stored Cross-Site ScriptingCVE-2023-5703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in all versions up to, and including, 2.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gift Up Gift Cards for WordPress and WooCommerce
Affected
up to 2.20.1
What to do
Affects up to 2.20.1. Update Gift Up Gift Cards for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2023SendPress Newsletters: Stored Cross-Site ScriptingCVE-2023-5660 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.22.3.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SendPress Newsletters
Affected
up to 1.22.3.31
What to do
Affects up to 1.22.3.31. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2023Video Gallery – Best WordPress YouTube Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-45069 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Video Gallery by Total-Soft Video Gallery – Best WordPress YouTube Gallery Plugin allows SQL Injection.This issue affects Video Gallery – Best WordPress YouTube Gallery Plugin: from n/a through 2.1.3.
Product
Video Gallery – Best WordPress YouTube Gallery
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Video Gallery – Best WordPress YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Pressference Exporter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-45046 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressference Pressference Exporter allows SQL Injection.This issue affects Pressference Exporter: from n/a through 1.0.3.
Product
Pressference Exporter
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Pressference Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 3, 2023MapPress Maps for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-26015 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for WordPress mappress-google-maps-for-wordpress allows SQL Injection.This issue affects MapPress Maps for WordPress: from n/a through 2.85.4.
Product
MapPress Maps for
Affected
up to 2.85.4
What to do
Affects up to 2.85.4. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.