Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

357 results · page 5 of 8

Dec 12, 2024Planaday API: Reflected Cross-Site ScriptingCVE-2024-11804 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Planaday API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 11.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Planaday API
Affected
up to 11.4
What to do
Affects up to 11.4. Update Planaday API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024Ultimate Endpoints With Rest Api: Reflected Cross-Site ScriptingCVE-2024-12260 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Ultimate Endpoints With Rest Api
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Ultimate Endpoints With Rest Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024RapidLoad – Optimize Web Vitals Automatically: Unauthorized access of data and modification of dataCVE-2024-11840 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.
Product
RapidLoad – Optimize Web Vitals Automatically
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update RapidLoad – Optimize Web Vitals Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2024Contact Form to Any API: Missing AuthorizationCVE-2023-47871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6.
Product
Contact Form to Any API
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 7, 2024Mini Program API: Stored Cross-Site ScriptingCVE-2024-11380 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mini Program API
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Mini Program API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 30, 2024Capitalize My Title: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53760 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Capitalize My Title Capitalize My Title capitalize-my-title allows Stored XSS.This issue affects Capitalize My Title: from n/a through <= 0.5.3.
Product
Capitalize My Title
Affected
up to 0.5.3
What to do
Affects up to 0.5.3. Update Capitalize My Title to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 20, 2024MStore API – Create Native Android & iOS Apps On The Cloud: SQL InjectionCVE-2024-11179 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.15.7
What to do
Affects up to 4.15.7. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 9, 2024Bing Search API Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51692 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in askewbrook Bing Search API Integration abbs-bing-search allows Reflected XSS.This issue affects Bing Search API Integration: from n/a through <= 0.3.3.
Product
Bing Search API Integration
Affected
up to 0.3.3
What to do
Affects up to 0.3.3. Update Bing Search API Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024MaanStore API: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50487 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo MaanStore API maanstore-api allows Authentication Bypass.This issue affects MaanStore API: from n/a through <= 1.0.1.
Product
MaanStore API
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update MaanStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024Acnoo Flutter API: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50486 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API acnoo-flutter-api allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through <= 1.0.5.
Product
Acnoo Flutter API
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Acnoo Flutter API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024WP REST API FNS: Unrestricted Upload of File with Dangerous TypeCVE-2024-49329 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Upload a Web Shell to a Web Server.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
Product
WP REST API FNS
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP REST API FNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024WP REST API FNS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49328 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
Product
WP REST API FNS
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP REST API FNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized API key updateCVE-2023-7289 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytium_sw_save_api_keys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin API keys.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2024TI WooCommerce Wishlist: Is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL queryCVE-2024-9156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
TI WooCommerce Wishlist
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 27, 2024AI ChatBot with ChatGPT and Content Generator by AYS: Discloses the Open AI API KeyCVE-2024-7713 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain it
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Fixed in
2.1.0
What to do
Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 24, 2024REST API TO MiniProgram: Privilege escalationCVE-2024-8485 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's account, including administrators.
Product
REST API TO MiniProgram
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2024REST API TO MiniProgram: SQL InjectionCVE-2024-8484 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
REST API TO MiniProgram
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2024Contact Form to Any API: Stored Cross-Site ScriptingCVE-2024-7617 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form to Any API
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized user registrationCVE-2024-8269 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user account through the register() function. This makes it possible for unauthenticated attackers to create user accounts on sites, even when user registration is disabled and plugin functionality is not activated.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.15.3
What to do
Affects up to 4.15.3. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Arbitrary file uploadsCVE-2024-8242 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files (not including PHP files) on the affected site's server which may make remote code execution possible. This can be paired with a registration endpoint for unauthenticated users to exploit the issue.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.15.3
What to do
Affects up to 4.15.3. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in allCVE-2024-7870 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files.
Affected
up to 9.7.1
What to do
Affects up to 9.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 4, 2024Sensei LMS: Does not properly protect some its REST API routesCVE-2024-7786 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.
Product
Sensei LMS
Fixed in
4.24.2
What to do
Update Sensei LMS to 4.24.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 1, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Unauthorized Malichimp API key updateCVE-2024-5053 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.1.18
What to do
Affects up to 5.1.18. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Authentication bypassCVE-2024-7628 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an @flutter.io email address or phone number. This also requires firebase to be configured on the website and the user to have set up firebase for their account.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.15.2
What to do
Affects up to 4.15.2. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 19, 2024PayPlus Payment Gateway: Does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated usersCVE-2024-6205 · WordPress plugins & themes · reported by WPScanCritical 9.8
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
Product
PayPlus Payment Gateway
Fixed in
6.6.9
What to do
Update PayPlus Payment Gateway to 6.6.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2024Meks Video Importer: Unauthorized API key modificationCVE-2024-6599 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API keys. CVE-2024-38733 may be a duplicate of this issue.
Product
Meks Video Importer
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Meks Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Unauthorized API accessCVE-2024-5703 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized API access due to a missing capability check in all versions up to, and including, 5.7.26. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access the API (provided it is enabled) and add, edit, and delete audience users.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.26
What to do
Affects up to 5.7.26. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Authentication bypassCVE-2024-6328 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_login' and 'firebase_sms_login_v2' functions. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email address or phone number. Additionally, if a new email address is supplied, a new user account is created with the default role, even if registration is disabled.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.14.7
What to do
Affects up to 4.14.7. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2024JSON API User: Privilege escalationCVE-2024-6624 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin requires the JSON API plugin to also be installed.
Product
JSON API User
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update JSON API User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024SEOPress: Does not properly protect some of its REST API routesCVE-2024-5488 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
Product
SEOPress
Fixed in
7.9
What to do
Update SEOPress to 7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 25, 2024WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and outpuCVE-2024-6307 · WordPress plugins & themes · reported by WordfenceMedium 6.4
WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Jun 12, 2024Newsletter - API v1 and v2 addon: Unauthorized subscribers managementCVE-2024-5674 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0
Product
Newsletter - API v1 and v2 addon
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Newsletter - API v1 and v2 addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record thenewsletterplugin.com wordfence.com
May 6, 2024Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: Missing AuthorizationCVE-2024-34377 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3.
Product
Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 1, 2024Geo Controller: Unserializes user input via some of its AJAX actions and REST API routesCVE-2024-3591 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Product
Geo Controller
Fixed in
8.6.5
What to do
Update Geo Controller to 8.6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Forms to Zapier, Integromat, IFTTT, Workato, Automate.Io, elastic.Io, Built.Io, APIANT, Webhook: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32134 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Forms to Zapier, Integromat, IFTTT, Workato, Automate.Io, elastic.Io, Built.Io, APIANT, Webhook.This issue affects Forms to Zapier, Integromat, IFTTT, Workato, Automate.Io, elastic.Io, Built.Io, APIANT, Webhook: from n/a through 1.1.12.
Product
Forms to Zapier, Integromat, IFTTT, Workato, Automate.Io, elastic.Io, Built.Io, APIANT, Webhook
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update Forms to Zapier, Integromat, IFTTT, Workato, Automate.Io, elastic.Io, Built.Io, APIANT, Webhook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024WP Go Maps (formerly WP Google Maps): Unauthenticated API key disclosureCVE-2023-6777 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due to the plugin adding the API key to several plugin files. This makes it possible for unauthenticated attackers to obtain the developer's Google API key. While this does not affect the security of sites using this plugin, it allows unauthenticated attackers to make requests using this API key with the potential of exhausting requests resulting in an inability to use the map functionality offered by the plugin.
Product
WP Go Maps (formerly WP Google Maps)
Affected
up to 9.0.34
What to do
Affects up to 9.0.34. Update WP Go Maps (formerly WP Google Maps) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 7, 2024RapidLoad Power-Up for Autoptimize: Server-Side Request Forgery (SSRF)CVE-2024-31288 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize.This issue affects RapidLoad Power-Up for Autoptimize: from n/a through 2.2.11.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Contact Form to Any API: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30242 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions Contact Form to Any API.This issue affects Contact Form to Any API: from n/a through 1.1.8.
Product
Contact Form to Any API
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1861 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_truncate_scan_table() function in all versions up to, and including, 4.52. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate the scan table.
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.52
What to do
Affects up to 4.52. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Unauthorized modification of dataCVE-2024-1860 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_add_whitelist() function in all versions up to, and including, 4.51. This makes it possible for unauthenticated attackers to add their IP Address to the whitelist circumventing protection
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.51
What to do
Affects up to 4.51. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2024School Management: Contains an obfuscated backdoor injected in it's license checking code that registers a REST API handlerCVE-2022-1609 · WordPress plugins & themes · reported by WPScanCritical 9.8
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
Product
School Management
Fixed in
9.9.7
What to do
Update School Management to 9.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024WP Go Maps (formerly WP Google Maps): Does not properly protect most of its REST API routesCVE-2023-6627 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attackers can abuse to store malicious HTML/Javascript on the site.
Product
WP Go Maps (formerly WP Google Maps)
Fixed in
9.0.28
What to do
Update WP Go Maps (formerly WP Google Maps) to 9.0.28 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 29, 2023MStore API: Cross-Site Request Forgery (CSRF)CVE-2023-50878 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1.
Product
MStore API
Affected
up to 4.10.1
What to do
Affects up to 4.10.1. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Cross-Site Request Forgery (CSRF)CVE-2023-50858 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34.
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Affected
up to 4.34
What to do
Affects up to 4.34. Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 26, 2023WP Mail Log: Does not correctly authorize its REST API endpointsCVE-2023-5644 · WordPress plugins & themes · reported by WPScanHigh 7.6
The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 7, 2023Password Reset with Code for WordPress REST API: Improper Restriction of Excessive Authentication AttemptsCVE-2023-35039 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.
Product
Password Reset with Code for WordPress REST API
Affected
up to 0.0.15
What to do
Affects up to 0.0.15. Update Password Reset with Code for WordPress REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.1.4 versions.CVE-2023-27446 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.1.4 versions.
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.3.9.1 versions.CVE-2023-46620 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.3.9.1 versions.
Affected
up to 2.3.9.1
What to do
Affects up to 2.3.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WP MapIt: Stored Cross-Site ScriptingCVE-2023-5658 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP MapIt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_mapit' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP MapIt
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update WP MapIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2023Templately: Does not properly authorize the `saved-templates/delete` REST API callCVE-2023-5454 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts.
Product
Templately
Fixed in
2.2.6
What to do
Update Templately to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.