Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

3,904 results · page 48 of 79

Dec 4, 2024The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login pCVE-2024-11293 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
Affected
up to 1.7.9
What to do
Affects up to 1.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pieregister.com wordfence.com
Dec 3, 2024Dollie Hub – Build Your Own WordPress Cloud Platform: Information ExposureCVE-2024-12099 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Dollie Hub – Build Your Own WordPress Cloud Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.2.0 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Dollie Hub – Build Your Own WordPress Cloud Platform
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Dollie Hub – Build Your Own WordPress Cloud Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 3, 2024Contact Form, Survey & Form Builder – MightyForms: Stored Cross-Site ScriptingCVE-2024-11897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form, Survey & Form Builder – MightyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mightyforms' shortcode in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form, Survey & Form Builder – MightyForms
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Contact Form, Survey & Form Builder – MightyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 3, 2024Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: PHP Object InjectionCVE-2024-10587 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.5.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
Affected
up to 3.7.5.1
What to do
Affects up to 3.7.5.1. Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 3, 2024Campaign Monitor Forms by Optin Cat: Reflected Cross-Site ScriptingCVE-2024-11326 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Campaign Monitor Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Campaign Monitor Forms by Optin Cat
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update Campaign Monitor Forms by Optin Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 3, 2024Charity Addon for Elementor: Information ExposureCVE-2024-12062 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Charity Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.3 via the 'nacharity_elementor_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Charity Addon for Elementor
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Charity Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 3, 2024AWeber Forms by Optin Cat: Reflected Cross-Site ScriptingCVE-2024-11325 · WordPress plugins & themes · reported by WordfenceMedium 5.2
The AWeber Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AWeber Forms by Optin Cat
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update AWeber Forms by Optin Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 3, 2024Form Data Collector: Reflected Cross-Site ScriptingCVE-2024-11461 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Form Data Collector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Form Data Collector
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Form Data Collector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2024Smart Marketing SMS and Newsletters Forms: Missing AuthorizationCVE-2024-53784 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in E-goi Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Marketing SMS and Newsletters Forms: from n/a through <= 5.0.4.
Product
Smart Marketing SMS and Newsletters Forms
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update Smart Marketing SMS and Newsletters Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 30, 2024Content Audit Exporter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-53768 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ideinteractive Content Audit Exporter content-audit-exporter allows Retrieve Embedded Sensitive Data.This issue affects Content Audit Exporter: from n/a through <= 1.1.
Product
Content Audit Exporter
Affected
up to 1.1
What to do
Affects up to 1.1. Update Content Audit Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024Royal Elementor Addons and Templates: Information ExposureCVE-2024-10798 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1003 via the 'wpr-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Product
Royal Elementor Addons and Templates
Affected
up to 1.7.1003
What to do
Affects up to 1.7.1003. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 28, 2024Restaurant & Cafe Addon for Elementor: Information ExposureCVE-2024-10780 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.9 via the 'narestaurant_elementor_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Restaurant & Cafe Addon for Elementor
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 28, 2024Primary Addon for Elementor: Information ExposureCVE-2024-10670 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via the [prim_elementor_template] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created with Elementor that they should not have access to.
Product
Primary Addon for Elementor
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 27, 2024WordPress Contact Forms by Cimatti: Cross-Site Request ForgeryCVE-2024-10521 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to delete forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WordPress Contact Forms by Cimatti
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update WordPress Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2024Hustle – Email Marketing, Lead Generation, Optins, Popups: Unauthorized form submissionsCVE-2024-10580 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability check on the submit_form() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to submit unpublished forms.
Product
Hustle – Email Marketing, Lead Generation, Optins, Popups
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update Hustle – Email Marketing, Lead Generation, Optins, Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2024Pricing Tables For WPBakery Page Builder (formerly Visual Composer): Stored Cross-Site ScriptingCVE-2024-10175 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wdo_pricing_tables shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.4
What to do
Affects up to 1.4. Update Pricing Tables For WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 27, 2024ProfilePress: Sensitive Information ExposureCVE-2024-11083 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
ProfilePress
Affected
up to 4.15.18
What to do
Affects up to 4.15.18. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 26, 2024Jeg Elementor Kit: Sensitive Information ExposureCVE-2024-8899 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the render_content function in class/elements/views/class-tabs-view.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
Jeg Elementor Kit
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 26, 2024Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-10471 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Everest Forms
Fixed in
3.0.4.2
What to do
Update Everest Forms to 3.0.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Nov 25, 2024WPForms: Does not sanitise and escape some of its settingsCVE-2024-7056 · WordPress plugins & themes · reported by WPScanLow 3.5
The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WPForms
Fixed in
1.9.1.6
What to do
Update WPForms to 1.9.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Nov 23, 2024The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation: Arbitrary shortcode executionCVE-2024-11034 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable to arbitrary shortcode execution via fire_contact_form AJAX action in all versions up to, and including, 1.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation
Affected
up to 1.4
What to do
Affects up to 1.4. Update The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 23, 2024Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: POST-Based Reflected Cross-Site ScriptingCVE-2024-11188 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Reflected Cross-Site Scripting via the Custom HTML Form parameters in all versions up to, and including, 6.16.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Affected
up to 6.16.1.2
What to do
Affects up to 6.16.1.2. Update Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 23, 2024HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents: Stored Cross-Site ScriptingCVE-2024-11332 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hipaatizer' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2024Enter Addons – Ultimate Template Builder for Elementor: Information ExposureCVE-2024-10868 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.9 via the Advanced Tabs widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Enter Addons – Ultimate Template Builder for Elementor
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Enter Addons – Ultimate Template Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 22, 2024Product Table for WooCommerce by CodeAstrology (wooproducttable.com): Sensitive Information ExposureCVE-2024-10813 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1 via the var_dump_table parameter. This makes it possible for unauthenticated attackers var data.
Product
Product Table for WooCommerce by CodeAstrology (wooproducttable.com)
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Product Table for WooCommerce by CodeAstrology (wooproducttable.com) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024Easy Twitter Feed – Twitter feeds plugin for WP: Information ExposureCVE-2024-10666 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the [etf] shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Easy Twitter Feed – Twitter feeds plugin for WP
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Easy Twitter Feed – Twitter feeds plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 21, 2024Anonymous Restricted Content: Sensitive Information ExposureCVE-2024-11089 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to logged-in users.
Product
Anonymous Restricted Content
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Anonymous Restricted Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Simple Membership: Sensitive Information ExposureCVE-2024-11088 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Simple Membership
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Formidable Forms: Does not sanitise and escape some of its settingsCVE-2024-9768 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Formidable Forms
Fixed in
6.14.1
What to do
Update Formidable Forms to 6.14.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 21, 2024Sky Addons for Elementor: Sensitive Information ExposureCVE-2024-9542 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the render function in modules/content-switcher/widgets/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
Product
Sky Addons for Elementor
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Sky Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Contact Form 7 Email Add on: Local File InclusionCVE-2024-10898 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the cf7_email_add_on_add_admin_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included.
Product
Contact Form 7 Email Add on
Affected
up to 1.9
What to do
Affects up to 1.9. Update Contact Form 7 Email Add on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2024If-So Dynamic Content Personalization: Information ExposureCVE-2024-10796 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Product
If-So Dynamic Content Personalization
Affected
up to 1.9.2.1
What to do
Affects up to 1.9.2.1. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Theme Builder For Elementor: Information ExposureCVE-2024-10782 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Theme Builder For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Theme Builder For Elementor
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Theme Builder For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Button Block – Get fully customizable & multi-functional buttons: Information ExposureCVE-2024-10671 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Button Block – Get fully customizable & multi-functional buttons
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Button Block – Get fully customizable & multi-functional buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Stratum – Elementor Widgets: Sensitive Information ExposureCVE-2024-10316 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/templates/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
Stratum – Elementor Widgets
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Stratum – Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 20, 2024PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Sensitive Information ExposureCVE-2024-11154 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
Product
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
Affected
up to 3.5.15
What to do
Affects up to 3.5.15. Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 20, 2024MailChimp Forms by MailMunch: Reflected Cross-Site ScriptingCVE-2024-8726 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MailChimp Forms by MailMunch
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 20, 2024The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Sensitive Information ExposureCVE-2024-10365 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tp_carousel_anything.php, modules/widgets/tp_page_scroll.php, and other widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 19, 2024Websand Subscription Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51923 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Websand Websand Subscription Form websand-subscription-form allows Stored XSS.This issue affects Websand Subscription Form: from n/a through <= 1.0.3.
Product
Websand Subscription Form
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Websand Subscription Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024SV Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51877 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in straightvisions GmbH SV Forms sv-forms allows DOM-Based XSS.This issue affects SV Forms: from n/a through <= 2.0.05.
Product
SV Forms
Affected
up to 2.0.05
What to do
Affects up to 2.0.05. Update SV Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Tigris Flexplatform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51819 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tigrisflexplatform Tigris Flexplatform tigris-flexplatform allows Stored XSS.This issue affects Tigris Flexplatform: from n/a through <= 1.0.2.
Product
Tigris Flexplatform
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Tigris Flexplatform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50515 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
Product
Ninja Forms
Affected
up to 3.8.16
What to do
Affects up to 3.8.16. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50514 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
Product
Ninja Forms
Affected
up to 3.8.16
What to do
Affects up to 3.8.16. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup: Arbitrary shortcode executionCVE-2024-11038 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, and including, 1.7.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Nov 18, 2024Mage Front End Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52339 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maximilian Ruthe Mage Front End Forms mage-forms allows Stored XSS.This issue affects Mage Front End Forms: from n/a through <= 1.1.4.
Product
Mage Front End Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Mage Front End Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52347 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpwebsitecreator Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera wp-website-creator allows Stored XSS.This issue affects Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera: from n/a through <= 4.0.
Product
Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera
Affected
up to 4.0
What to do
Affects up to 4.0. Update Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024Google for WooCommerce: Information DisclosureCVE-2024-10486 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
Product
Google for WooCommerce
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Google for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 16, 2024404 Solution: Sensitive Information ExposureCVE-2024-11094 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. This makes it possible for unauthenticated attackers to extract data such as redirects including GET parameters which may reveal sensitive information. On most sites this is unlikely to be the case.
Product
404 Solution
Affected
up to 2.35.17
What to do
Affects up to 2.35.17. Update 404 Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024EleForms – All In One Form Integration including DB for Elementor: Cross-Site Request ForgeryCVE-2024-6628 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.9.9. This is due to missing or incorrect nonce validation when deleting form submissions. This makes it possible for unauthenticated attackers to delete form submissions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
EleForms – All In One Form Integration including DB for Elementor
Affected
up to 2.9.9.9
What to do
Affects up to 2.9.9.9. Update EleForms – All In One Form Integration including DB for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 15, 2024SimpleForm Contact Form Submissions: Reflected Cross-Site ScriptingCVE-2024-10884 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SimpleForm Contact Form Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SimpleForm Contact Form Submissions
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update SimpleForm Contact Form Submissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.