Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
416 results · page 5 of 9
Jan 7, 2025JobBoard Job listing: Unrestricted Upload of File with Dangerous TypeCVE-2024-43243 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through <= 1.2.6.
- Product
- JobBoard Job listing
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update JobBoard Job listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 4, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: SQL InjectionCVE-2024-12195 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, who have been granted access to a project, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
- Affected
- up to 2.6.16
- What to do
- Affects up to 2.6.16. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 3, 2025WP Job Portal – A Complete Recruitment System for Company or Job Board website: Insecure Direct Object ReferenceCVE-2024-12132 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create jobs for companies that are unaffiliated with the attacker.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 2, 2025Custom Dashboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56024 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Reflected XSS.This issue affects Custom Dashboard Widget: from n/a through <= 1.0.0.
- Product
- Custom Dashboard Widget
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Dashboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Simple Job Board: Missing AuthorizationCVE-2023-47188 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PressTigers Simple Job Board simple-job-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Job Board: from n/a through <= 2.10.5.
- Product
- Simple Job Board
- Affected
- up to 2.10.5
- What to do
- Affects up to 2.10.5. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Simple Dashboard: Incorrect Privilege AssignmentCVE-2024-56071 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in mikeleembruggen Simple Dashboard simple-dashboard allows Privilege Escalation.This issue affects Simple Dashboard: from n/a through <= 2.0.
- Product
- Simple Dashboard
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Simple Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Job Board Manager: Missing AuthorizationCVE-2024-55993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- Product
- Job Board Manager
- Affected
- up to 2.1.61
- What to do
- Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024LeaderBoard: Cross-Site Request Forgery (CSRF)CVE-2024-54426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in crossfitatgg LeaderBoard Plugin leaderboard-lite allows Stored XSS.This issue affects LeaderBoard Plugin: from n/a through <= 1.2.4.
- Product
- LeaderBoard
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update LeaderBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized accessCVE-2024-11715 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an employer.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL InjectionCVE-2024-11714 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'ff' parameter of the getFieldsForVisibleCombobox() function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL InjectionCVE-2024-11713 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'page_id' parameter of the wpjobportal_deactivate() function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized access of dataCVE-2024-11712 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getResumeFileDownloadById() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to download other users resumes.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL InjectionCVE-2024-11711 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'resumeid' parameter in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: SQL InjectionCVE-2024-11710 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'fieldfor', 'visibleParent' and 'id' parameters in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 13, 2024Board Document Manager from CHUHPL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.This issue affects Board Document Manager from CHUHPL: from n/a through <= 1.9.1.
- Product
- Board Document Manager from CHUHPL
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Board Document Manager from CHUHPL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites: Privilege escalationCVE-2024-10783 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.
- Product
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 10, 2024System Dashboard: Does not sanitise and escape some parametersCVE-2024-11107 · WordPress plugins & themes · reported by WPScanMedium 6.1
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- System Dashboard
- Fixed in
- 2.8.15
- What to do
- Update System Dashboard to 2.8.15 or newer.
Dec 10, 2024System Dashboard: Does not validate user input used in a pathCVE-2024-10708 · WordPress plugins & themes · reported by WPScanMedium 4.9
The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server
- Product
- System Dashboard
- Fixed in
- 2.8.15
- What to do
- Update System Dashboard to 2.8.15 or newer.
Dec 9, 2024JobBoardWP – Job Board Listings and Submissions: Missing AuthorizationCVE-2023-23715 · WordPress plugins & themes · reported by PatchstackMedium 5.2
Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoardWP – Job Board Listings and Submissions: from n/a through 1.2.2.
- Product
- JobBoardWP – Job Board Listings and Submissions
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update JobBoardWP – Job Board Listings and Submissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024ForumWP – Forum & Discussion Board: Reflected Cross-Site ScriptingCVE-2024-11204 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- ForumWP – Forum & Discussion Board
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update ForumWP – Forum & Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2024ForumWP – Forum & Discussion Board: Reflected Cross-Site ScriptingCVE-2024-10879 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- ForumWP – Forum & Discussion Board
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update ForumWP – Forum & Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 28, 2024JobSearch WP Job Board: Privilege escalationCVE-2024-11925 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.7. This is due to the plugin not properly verifying a users identity when verifying an email address through the user_account_activation function. This makes it possible for unauthenticated attackers to log in as any user, including site administrators if the users email is known.
- Product
- JobSearch WP Job Board
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 23, 2024JobBoardWP – Job Board Listings and Submissions: Reflected Cross-Site ScriptingCVE-2024-10880 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- JobBoardWP – Job Board Listings and Submissions
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update JobBoardWP – Job Board Listings and Submissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024Custom Dashboard Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51860 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Custom Dashboard Widget create-custom-dashboard-widget allows Stored XSS.This issue affects Custom Dashboard Widget: from n/a through <= 1.0.0.
- Product
- Custom Dashboard Widget
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Dashboard Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2024-43338 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through <= 3.1.3.
- Product
- Crowdsignal Dashboard – Polls, Surveys & more
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Copy Anything to Clipboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52419 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clipboard Agency Copy Anything to Clipboard copy-the-code allows Stored XSS.This issue affects Copy Anything to Clipboard: from n/a through <= 4.0.3.
- Product
- Copy Anything to Clipboard
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Copy Anything to Clipboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2024WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Insecure Direct Object ReferenceCVE-2024-10174 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'Abstract_Permission' class due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to spoof their identity to that of an administrator and access all of the plugins REST routes.
- Product
- WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
- Affected
- up to 2.6.13
- What to do
- Affects up to 2.6.13. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2024JobSearch WP Job Board: Arbitrary file uploadsCVE-2024-8615 · WordPress plugins & themes · reported by WordfenceCritical 10
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_excel_file_callback() function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- JobSearch WP Job Board
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 6, 2024JobSearch WP Job Board: Arbitrary file uploadsCVE-2024-8614 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload() function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- JobSearch WP Job Board
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 1, 2024Kanban Boards for: Missing AuthorizationCVE-2024-37226 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kanban for WordPress Kanban Boards for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
- Product
- Kanban Boards for
- Affected
- up to 2.5.21
- What to do
- Affects up to 2.5.21. Update Kanban Boards for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2024WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer: Stored Cross-Site ScriptingCVE-2024-8959 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer
- Affected
- up to 4.0.1.6
- What to do
- Affects up to 4.0.1.6. Update WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 17, 2024Job Board Manager for: Incorrect Privilege AssignmentCVE-2024-49322 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress jemployee allows Privilege Escalation.This issue affects Job Board Manager for WordPress: from n/a through <= 1.0.
- Product
- Job Board Manager for
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Job Board Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Simple Baseball Scoreboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dogrow Simple Baseball Scoreboard simple-baseball-scoreboard allows Stored XSS.This issue affects Simple Baseball Scoreboard: from n/a through <= 1.3.
- Product
- Simple Baseball Scoreboard
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Simple Baseball Scoreboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance: Stored Cross-Site ScriptingCVE-2016-15041 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordklikki.fiweb.archive.org
Oct 11, 2024Download Plugins and Themes in ZIP from Dashboard: Reflected Cross-Site ScriptingCVE-2024-9232 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Download Plugins and Themes in ZIP from Dashboard
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2024MH Board: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44017 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MinHyeong Lim MH Board mh-board allows PHP Local File Inclusion.This issue affects MH Board: from n/a through <= 1.3.2.1.
- Product
- MH Board
- Affected
- up to 1.3.2.1
- What to do
- Affects up to 1.3.2.1. Update MH Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024Frontend Dashboard: Unauthorized code executionCVE-2024-8268 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords.
- Product
- Frontend Dashboard
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2024ForumWP – Forum & Discussion Board: Privilege EscalationCVE-2024-8428 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submit_form_handler due to missing validation on the 'user_id' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address of administrative user accounts which can then be leveraged to reset the administrative users password and gain access to their account.
- Product
- ForumWP – Forum & Discussion Board
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update ForumWP – Forum & Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Local File Inclusion, Arbitrary Settings Update, and User CreationCVE-2024-7950 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Attackers can also update arbitrary settings and create user accounts even when registration is disabled, leading to user creation with a default role of Administrator.
- Product
- WP Job Portal – A Complete Recruitment System for Company or Job Board website
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2024Dark Mode for WP Dashboard: Cross-Site Request Forgery (CSRF)CVE-2024-43325 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Naiche Dark Mode for WP Dashboard.This issue affects Dark Mode for WP Dashboard: from n/a through 1.2.3.
- Product
- Dark Mode for WP Dashboard
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Dark Mode for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2024Simple Job Board: PHP Object InjectionCVE-2024-7351 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Simple Job Board
- Affected
- up to 2.12.3
- What to do
- Affects up to 2.12.3. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 16, 2024Download Plugins and Themes in ZIP from Dashboard: Cross-Site Request ForgeryCVE-2024-7501 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the download_theme() function. This makes it possible for unauthenticated attackers to download arbitrary themes from the website via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. In versions prior to 1.8.6 it was possible to download the entire sites files.
- Product
- Download Plugins and Themes in ZIP from Dashboard
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 12, 2024WP Dashboard Notes: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43226 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jeroen Sormani WP Dashboard Notes allows Stored XSS.This issue affects WP Dashboard Notes: from n/a through 1.0.11.
- Product
- WP Dashboard Notes
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update WP Dashboard Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 20, 2024Admin Dashboard RSS Feed: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38725 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webstix Admin Dashboard RSS Feed allows Stored XSS.This issue affects Admin Dashboard RSS Feed: from n/a through 3.1.
- Product
- Admin Dashboard RSS Feed
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Admin Dashboard RSS Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 20, 2024Job Board Manager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38722 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Stored XSS.This issue affects Job Board Manager: from n/a through 2.1.57.
- Product
- Job Board Manager
- Affected
- up to 2.1.57
- What to do
- Affects up to 2.1.57. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 21, 2024WP Logs Book: Does not sanitise and escape some of its log data before outputting them back in an admin dashboardCVE-2024-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting
- Product
- WP Logs Book
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2024Hide Dashboard Notifications: Unauthorized modification of dataCVE-2024-1955 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_notices_settings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's settings.
- Product
- Hide Dashboard Notifications
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Hide Dashboard Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 13, 2024Kingkong Board: Missing AuthorizationCVE-2023-36694 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Bryan Lee Kingkong Board.This issue affects Kingkong Board: from n/a through 2.1.0.2.
- Product
- Kingkong Board
- Affected
- up to 2.1.0.2
- What to do
- Affects up to 2.1.0.2. Update Kingkong Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 13, 2024Dashboard Widgets Suite: Reflected Cross-Site ScriptingCVE-2024-0979 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Dashboard Widgets Suite
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Dashboard Widgets Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 10, 2024Dashboard To-Do List: Missing AuthorizationCVE-2024-35723 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Andrew Dashboard To-Do List dashboard-to-do-list.This issue affects Dashboard To-Do List: from n/a through <= 1.2.0.
- Product
- Dashboard To-Do List
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Dashboard To-Do List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.