Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
795 results · page 5 of 16
Apr 4, 20251-Click Backup & Restore Database: Missing AuthorizationCVE-2025-32246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Tim Nguyen 1-Click Backup & Restore Database 1-click-backup-restore-database-by-sunbytes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1-Click Backup & Restore Database: from n/a through <= 1.0.3.
- Product
- 1-Click Backup & Restore Database
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update 1-Click Backup & Restore Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025History Log by click5: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31531 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in click5 History Log by click5 history-log-by-click5 allows SQL Injection.This issue affects History Log by click5: from n/a through <= 1.0.13.
- Product
- History Log by click5
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update History Log by click5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Click to Chat – WP Support All-in-One Floating Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31092 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through <= 2.3.4.
- Product
- Click to Chat – WP Support All-in-One Floating Widget
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update Click to Chat – WP Support All-in-One Floating Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost.CVE-2025-1385 · Other software · ClickHouse · reported by cb7ba516-3b07-4c98-b0c2-715220f1a8f6High 7.5
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>
- Product
- ClickHouse OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025InstaWP Connect – 1-click WP Staging & Migration: Cross-Site Request ForgeryCVE-2024-13913 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- InstaWP Connect – 1-click WP Staging & Migration
- Affected
- up to 0.1.0.83
- What to do
- Affects up to 0.1.0.83. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2025WP Click Info: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1401 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Click Info WordPress plugin through 2.7.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Click Info
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update WP Click Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap: Does not sanitise and escape some of its settingsCVE-2024-13615 · WordPress plugins & themes · reported by WPScanLow 3.5
The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 10, 2025A clickjacking issue was addressed with improved out-of-process view handling.CVE-2024-54558 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.8
A clickjacking issue was addressed with improved out-of-process view handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to trick a user into granting access to photos from the user's photo library.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 3, 2025ClickBank Storefront: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23524 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dactum ClickBank Storefront mycbgenie-clickbank-storefront allows Reflected XSS.This issue affects ClickBank Storefront: from n/a through <= 1.7.
- Product
- ClickBank Storefront
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update ClickBank Storefront to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025ClickWhale: Cross-Site Request Forgery (CSRF)CVE-2025-26963 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ClickWhale ClickWhale clickwhale allows Cross Site Request Forgery.This issue affects ClickWhale: from n/a through <= 2.4.3.
- Product
- ClickWhale
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Sensitive Information ExposureCVE-2024-13609 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.
- Product
- 1 Click WordPress Migration Plugin – 100% FREE for a limited time
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Cross-Site Request ForgeryCVE-2024-13555 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancel_actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- 1 Click WordPress Migration Plugin – 100% FREE for a limited time
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 12, 2025Click Mag - Viral WordPress News Magazine/Blog: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13656 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including, 3.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
- Product
- Click Mag - Viral WordPress News Magazine/Blog
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update Click Mag - Viral WordPress News Magazine/Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 10, 2025SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking.CVE-2025-24874 · Websites & servers · SAP_SE · reported by cna@sap.comMedium 6.8
SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information.
- Product
- SAP Commerce (Backoffice)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim.CVE-2024-49796 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
- Product
- ApplinX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.CVE-2025-24503 · Other software · Broadcom · reported by secure@symantec.comCritical 9.3
A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.
- Product
- Symantec Privileged Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: Stored Cross-Site ScriptingCVE-2025-0804 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via link titles in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 21, 2025In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the code.CVE-2024-49736 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Clickjacking vulnerability in typecho v1.2.1.CVE-2024-57369 · Other software · Typecho · reported by MITREMedium 6.4
Clickjacking vulnerability in typecho v1.2.1.
- Product
- Typecho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroyblume.github.io
Jan 10, 2025ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages: Reflected Cross-Site ScriptingCVE-2024-11327 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2025WhatsApp 🚀 click to chat: Reflected Cross-Site ScriptingCVE-2024-11686 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WhatsApp 🚀 click to chat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'manycontacts_code' parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WhatsApp 🚀 click to chat
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update WhatsApp 🚀 click to chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 7, 2025ClickWhale: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51715 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickWhale ClickWhale clickwhale allows Blind SQL Injection.This issue affects ClickWhale: from n/a through <= 2.4.1.
- Product
- ClickWhale
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update ClickWhale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2025ClickDesigns: Unauthorized modification of dataCVE-2024-12559 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ClickDesigns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clickdesigns_add_api' and the 'clickdesigns_remove_api' functions in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to modify or remove the plugin's API key.
- Product
- ClickDesigns
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update ClickDesigns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 21, 2024The One Click Upsell Funnel for WooCommerce – Funnel Builder for WordPress, Create WooCommerce Upsell, Post-Purchase Upsell & Cross Sell Offers that Boost SaleCVE-2024-11938 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The One Click Upsell Funnel for WooCommerce – Funnel Builder for WordPress, Create WooCommerce Upsell, Post-Purchase Upsell & Cross Sell Offers that Boost Sales & Increase Profits with Sales Funnel Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wps_wocuf_pro_yes shortcode in all versions up to, and including, 3.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2024IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim.CVE-2021-29827 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.2
IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
- Product
- InfoSphere Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Click To Tweet: Missing AuthorizationCVE-2023-41857 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ClickToTweet.com Click To Tweet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Click To Tweet: from n/a through 2.0.14.
- Product
- Click To Tweet
- Affected
- up to 2.0.14
- What to do
- Affects up to 2.0.14. Update Click To Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 11, 2024Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the contexCVE-2024-50585 · Other software · Numerix LLC · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 4.7
Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the context of the "Numerix License Server Administration System Login" (nlslogin.jsp) page. The vulnerability can be triggered by sending a specially crafted HTTP POST request. The vendor was unresponsive during multiple attempts to contact them via various channels, hence there is no solution available. In case you are using this software, be sure to restrict access and monitor logs. Try to reach out to your contact person for this vendor and request a patch.
- Product
- License Server Administration System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Dec 9, 2024An injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core models, running firmware before 2.21.1, allows physically proxiCVE-2024-53919 · Other software · reported by MITREHigh 7.6
An injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core models, running firmware before 2.21.1, allows physically proximate attackers or local admins to the webUI to trigger OS-level command execution as root.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgbarco.com
Dec 6, 2024Clickbank WordPress Plugin (Storefront): Cross-Site Request ForgeryCVE-2024-11336 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Clickbank WordPress Plugin (Storefront) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing or incorrect nonce validation via the cs_menu page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Clickbank WordPress Plugin (Storefront)
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Clickbank WordPress Plugin (Storefront) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 28, 2024In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen.CVE-2024-54124 · Other software · clickstudios · reported by MITREHigh 8.8
In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen.
- Product
- passwordstate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclickstudios.com.auclickstudios.com.au
Nov 19, 2024Location Click Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51844 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kiran Patil Location Click Map location-click-map allows Stored XSS.This issue affects Location Click Map: from n/a through <= 1.0.
- Product
- Location Click Map
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Location Click Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Inline Click To Tweet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnetic Creative Inline Click To Tweet inline-click-to-tweet allows DOM-Based XSS.This issue affects Inline Click To Tweet: from n/a through <= 1.0.0.
- Product
- Inline Click To Tweet
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Inline Click To Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup: Arbitrary shortcode executionCVE-2024-11038 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, and including, 1.7.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Nov 12, 2024Buy one click WooCommerce: Unauthorized modification of dataCVE-2024-10854 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buy_one_click_import_options AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import plugin settings.
- Product
- Buy one click WooCommerce
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Buy one click WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 12, 2024Buy one click WooCommerce: Unauthorized modification of dataCVE-2024-10853 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete Buy one click WooCommerce orders.
- Product
- Buy one click WooCommerce
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Buy one click WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 12, 2024Buy one click WooCommerce: Unauthorized access of dataCVE-2024-10852 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the buy_one_click_export_options AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export plugin settings.
- Product
- Buy one click WooCommerce
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Buy one click WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 31, 2024Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel.CVE-2024-10454 · Other software · Clibo Manager · reported by cve-coordination@incibe.esMedium 6.1
Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Frame-Options server-side header. An attacker could overlay a transparent iframe to perform click hijacking on victims.
- Product
- Clibo Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024Swoop 1-Click Login: Passwordless Authentication: Authentication Bypass by Primary WeaknessCVE-2024-50478 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordless Authentication: 1.4.5.
- Product
- Swoop 1-Click Login: Passwordless Authentication
- What to do
- Update Swoop 1-Click Login: Passwordless Authentication to the newest version.
Oct 25, 2024funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.CVE-2024-48229 · Other software · funadmin · reported by MITREHigh 7.2
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.
- Product
- funadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).CVE-2024-48227 · Other software · funadmin · reported by MITREMedium 4.9
Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).
- Product
- funadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2024WP Content Copy Protection & No Right Click: Cross-Site Request Forgery (CSRF)CVE-2024-49306 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through <= 3.5.9.
- Product
- WP Content Copy Protection & No Right Click
- Affected
- up to 3.5.9
- What to do
- Affects up to 3.5.9. Update WP Content Copy Protection & No Right Click to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Click to Chat – WP Support All-in-One Floating Widget: Stored Cross-Site ScriptingCVE-2024-10055 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaio_snapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-49281 may be a duplicate of this issue.
- Product
- Click to Chat – WP Support All-in-One Floating Widget
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Click to Chat – WP Support All-in-One Floating Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 17, 2024Click to Chat – WP Support All-in-One Floating Widget: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-49281 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through <= 2.3.3.
- Product
- Click to Chat – WP Support All-in-One Floating Widget
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Click to Chat – WP Support All-in-One Floating Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024A Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via tCVE-2024-41516 · Other software · cadclick · reported by MITREMedium 5.4
A Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "bomid" parameter.
- Product
- cadclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024A reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script orCVE-2024-41515 · Other software · cadclick · reported by MITREMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "res_url" parameter.
- Product
- cadclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024A reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web scriptCVE-2024-41514 · Other software · cadclick · reported by MITREMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "wer" parameter.
- Product
- cadclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024A reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or CVE-2024-41513 · Other software · cadclick · reported by MITREMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "searchindex" parameter.
- Product
- cadclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024A SQL Injection vulnerability in "ccHandler.aspx" in all versions of CADClick v.1.11.0 and before allows remote attackers to execute arbitrary SQL commands via CVE-2024-41512 · Other software · cadclick · reported by MITREHigh 8.8
A SQL Injection vulnerability in "ccHandler.aspx" in all versions of CADClick v.1.11.0 and before allows remote attackers to execute arbitrary SQL commands via the "bomid" parameter.
- Product
- cadclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers to retrieve arbitrarCVE-2024-41511 · Other software · cadclick · reported by MITRELow 3.9
A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers to retrieve arbitrary local files via the "path" parameter.
- Product
- cadclick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024Easy Demo Importer – A Modern One-Click Demo Import Solution: Stored Cross-Site ScriptingCVE-2024-9071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Easy Demo Importer – A Modern One-Click Demo Import Solution
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Easy Demo Importer – A Modern One-Click Demo Import Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.