Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

496 results · page 5 of 10

Dec 9, 2024Flexible Woocommerce Checkout Field Editor: Missing AuthorizationCVE-2023-49817 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in heoLixfy Flexible Woocommerce Checkout Field Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Woocommerce Checkout Field Editor: from n/a through 2.0.1.
Product
Flexible Woocommerce Checkout Field Editor
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Flexible Woocommerce Checkout Field Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Conditional Fields for Contact Form 7: Missing AuthorizationCVE-2023-47838 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.1.
Product
Conditional Fields for Contact Form 7
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Conditional Fields for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Display custom fields in the frontend – Post and User Profile Fields: Missing AuthorizationCVE-2023-31073 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0.
Product
Display custom fields in the frontend – Post and User Profile Fields
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 26, 2024Product Input Fields for WooCommerce: Directory TraversalCVE-2024-10857 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Product Input Fields for WooCommerce
Affected
up to 1.9
What to do
Affects up to 1.9. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin beforeCVE-2024-9529 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
Fixed in
6.3.9
What to do
Update the plugin to 6.3.9 or newer.
Full record and what to do →NVD record wpscan.com
Nov 13, 2024WordPress User Extra Fields: Arbitrary file deletionCVE-2024-11150 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WordPress User Extra Fields
Affected
up to 16.6
What to do
Affects up to 16.6. Update WordPress User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 13, 2024WordPress User Extra Fields: Privilege escalationCVE-2024-10800 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function in all versions up to, and including, 16.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to add custom fields that can be updated and then use the check_and_overwrite_wp_or_woocommerce_fields function to update the wp_capabilities field to have administrator privileges.
Product
WordPress User Extra Fields
Affected
up to 16.6
What to do
Affects up to 16.6. Update WordPress User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 9, 2024WordPress User Extra Fields: Arbitrary file uploadsCVE-2024-10801 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. User registration must be enabled for this to be exploited.
Product
WordPress User Extra Fields
Affected
up to 16.5
What to do
Affects up to 16.5. Update WordPress User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 1, 2024Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2024-43235 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.9.10.
Product
Meta Box – WordPress Custom Fields Framework
Affected
up to 5.9.10
What to do
Affects up to 5.9.10. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37250 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
Product
Advanced Custom Fields PRO
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37249 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
Product
Advanced Custom Fields PRO
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Conditional Fields for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50412 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Stored XSS.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.15.
Product
Conditional Fields for Contact Form 7
Affected
up to 2.4.15
What to do
Affects up to 2.4.15. Update Conditional Fields for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Todo Custom Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49642 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi Todo Custom Field todo-custom-field allows Reflected XSS.This issue affects Todo Custom Field: from n/a through <= 3.0.4.
Product
Todo Custom Field
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Todo Custom Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2024Contact Form 7 – Repeatable Fields: Stored Cross-Site ScriptingCVE-2024-10180 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's field_group shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form 7 – Repeatable Fields
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Contact Form 7 – Repeatable Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 22, 2024Category and Taxonomy Meta Fields: Stored Cross-Site ScriptingCVE-2024-9590 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in the 'wpaft_add_meta_textinput' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Category and Taxonomy Meta Fields
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2024Category and Taxonomy Meta Fields: Stored Cross-Site ScriptingCVE-2024-9589 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in the 'wpaft_option_page' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Category and Taxonomy Meta Fields
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2024Category and Taxonomy Meta Fields: Cross-Site Request ForgeryCVE-2024-9588 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible for unauthenticated attackers to add and delete taxonomy meta, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Category and Taxonomy Meta Fields
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 17, 2024In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plCVE-2024-49593 · WordPress plugins & themes · reported by MITREMedium 5.3
In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.
Fixed in
6.3.9
What to do
Update the plugin to 6.3.9 or newer.
Full record and what to do →NVD record wordpress.org advancedcustomfields.com
Oct 16, 2024Calculated Fields Form: HTML InjectionCVE-2024-9940 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from submitted forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email.
Product
Calculated Fields Form
Affected
up to 5.2.45
What to do
Affects up to 5.2.45. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024plugin ACF Quick Edit Fields: Insecure Direct Object ReferenceCVE-2023-7286 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin ACF Quick Edit Fields for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.2.2. This makes it possible for attackers without the edit_users capability to access metadata of other users, this includes contributor-level users and above.
Product
plugin ACF Quick Edit Fields
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update plugin ACF Quick Edit Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 4, 2024Checkout Field Editor (Checkout Manager) for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-8499 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Checkout Field Editor (Checkout Manager) for WooCommerce
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Checkout Field Editor (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2024WP Custom Fields Search: Stored Cross-Site ScriptingCVE-2024-8364 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all versions up to, and including, 1.2.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Custom Fields Search
Affected
up to 1.2.35
What to do
Affects up to 1.2.35. Update WP Custom Fields Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 15, 2024Custom Field Template: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44062 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.5.
Product
Custom Field Template
Affected
up to 2.6.5
What to do
Affects up to 2.6.5. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 12, 2024CM Pop-Up Banners for: Does not sanitise and escape some of its popup fieldsCVE-2024-5799 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as Contributors to perform Cross-Site Scripting attacks.
Product
CM Pop-Up Banners for
Fixed in
1.7.3
What to do
Update CM Pop-Up Banners for to 1.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2024Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier.CVE-2024-45429 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.
Affected
up to 6.3.5
What to do
Affects up to 6.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Aug 26, 2024Quiz and Survey Master (QSM): Fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embeddedCVE-2024-6879 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.
Product
Quiz and Survey Master (QSM)
Fixed in
9.1.1
What to do
Update Quiz and Survey Master (QSM) to 9.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2024Meta Field Block: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43278 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Phi Phan Meta Field Block allows Stored XSS.This issue affects Meta Field Block: from n/a through 1.2.13.
Product
Meta Field Block
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update Meta Field Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 15, 2024Custom Field For WP Job Manager: Insecure Direct Object ReferenceCVE-2023-7049 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field For WP Job Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2 via the the 'cm_fieldshow' shortcode due to missing validation on the 'job_id' user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.
Product
Custom Field For WP Job Manager
Affected
up to 1.2
What to do
Affects up to 1.2. Update Custom Field For WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 19, 2024Conditional Fields for Contact Form 7: Cross-Site Request ForgeryCVE-2024-5804 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is due to missing or incorrect nonce validation on the wpcf7cf_admin_init function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Conditional Fields for Contact Form 7
Affected
up to 2.4.13
What to do
Affects up to 2.4.13. Update Conditional Fields for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2024wp-eMember: Does not sanitise and escape some of the fieldsCVE-2024-5079 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenticated users to perform Stored Cross-Site Scripting attacks
Product
wp-eMember
Fixed in
10.6.7
What to do
Update wp-eMember to 10.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 9, 2024Just Custom Fields: Cross-Site Request ForgeryCVE-2024-6168 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on several AJAX function. This makes it possible for unauthenticated attackers to invoke this functionality intended for admin users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This enables subscribers to manage field groups, change visibility of items among other things.
Product
Just Custom Fields
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Just Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 9, 2024Just Custom Fields: Unauthorized access of functionalityCVE-2024-6167 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Just Custom Fields plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several AJAX functions in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke this functionality intended for admin users. This enables subscribers to manage field groups, change visibility of items among other things.
Product
Just Custom Fields
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Just Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 1, 2024Quiz and Survey Master (QSM): Does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embedCVE-2024-4934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Quiz and Survey Master (QSM)
Fixed in
9.0.2
What to do
Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2024The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values fCVE-2024-4565 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access
Product
Advanced Custom Fields (ACF)
Fixed in
6.3
What to do
Update Advanced Custom Fields (ACF) to 6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2024Custom Field Suite: PHP Code InjectionCVE-2024-3562 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is due to insufficient sanitization of input prior to being used in a call to the eval() function. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary PHP code on the server.
Product
Custom Field Suite
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update Custom Field Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jun 19, 2024Custom Field Suite: SQL InjectionCVE-2024-3561 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and including, 2.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Custom Field Suite
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update Custom Field Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record en-gb.wordpress.org github.com
Jun 19, 2024Custom Field Suite: Stored Cross-Site ScriptingCVE-2024-3558 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Custom Field Suite
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update Custom Field Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org en-gb.wordpress.org
Jun 17, 2024Popup Builder: Does not sanitise and escape some of its Notification fieldsCVE-2024-3236 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.
Product
Popup Builder
Fixed in
1.1.33
What to do
Update Popup Builder to 1.1.33 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2024Custom Field Suite: Stored Cross-Site ScriptingCVE-2024-3559 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_content]' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Custom Field Suite
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update Custom Field Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2024ACF Photo Gallery Field: Missing AuthorizationCVE-2024-23518 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Navneil Naicker ACF Photo Gallery Field.This issue affects ACF Photo Gallery Field: from n/a through 2.6.
Product
ACF Photo Gallery Field
Affected
up to 2.6
What to do
Affects up to 2.6. Update ACF Photo Gallery Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Custom Field Template: Stored Cross-Site ScriptingCVE-2024-0653 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Custom Field Template
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2024Custom Field Template: Stored Cross-Site ScriptingCVE-2024-0627 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Custom Field Template
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2024Custom Field Template: Sensitive Information ExposureCVE-2023-6748 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata.
Product
Custom Field Template
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2024Custom Field Template: Stored Cross-Site ScriptingCVE-2023-6745 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied post meta. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Custom Field Template
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2024Checkout Field Editor for WooCommerce (Pro): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35658 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeHigh Checkout Field Editor for WooCommerce (Pro) allows Functionality Misuse, File Manipulation.This issue affects Checkout Field Editor for WooCommerce (Pro): from n/a through 3.6.2.
Product
Checkout Field Editor for WooCommerce (Pro)
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Checkout Field Editor for WooCommerce (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Upload Fields for WPForms: Missing AuthorizationCVE-2024-35661 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2.
Product
Upload Fields for WPForms
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Upload Fields for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Filter Custom Fields & Taxonomies Light: Missing AuthorizationCVE-2024-32081 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Websupporter Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.
Product
Filter Custom Fields & Taxonomies Light
Affected
up to 1.05
What to do
Affects up to 1.05. Update Filter Custom Fields & Taxonomies Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Flexible Checkout Fields for WooCommerce: Missing AuthorizationCVE-2024-31267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2.
Product
Flexible Checkout Fields for WooCommerce
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Flexible Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024wp-eMember: Does not sanitize and escape the "fieldId" parameter before outputting it back in the pageCVE-2024-4749 · WordPress plugins & themes · reported by WPScanHigh 8.3
The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Product
wp-eMember
Fixed in
10.3.9
What to do
Update wp-eMember to 10.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 3, 2024Calculated Fields Form: Missing AuthorizationCVE-2023-26523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Calculated Fields Form allows Functionality Misuse.This issue affects Calculated Fields Form: from n/a through 1.1.120.
Product
Calculated Fields Form
Affected
up to 1.1.120
What to do
Affects up to 1.1.120. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.