Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

481 results · page 5 of 10

Aug 26, 2024Quiz and Survey Master (QSM): Fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embeddedCVE-2024-6879 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.
Product
Quiz and Survey Master (QSM)
Fixed in
9.1.1
What to do
Update Quiz and Survey Master (QSM) to 9.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2024EmbedPress: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43328 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress allows PHP Local File Inclusion.This issue affects EmbedPress: from n/a through 4.0.9.
Product
EmbedPress
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 8, 2024Gutenberg Blocks with AI by Kadence WP: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-6884 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenberg Blocks with AI by Kadence WP
Fixed in
3.2.39
What to do
Update Gutenberg Blocks with AI by Kadence WP to 3.2.39 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2024shortcodes-ultimate-pro: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6766 · WordPress plugins & themes · reported by WPScanMedium 5.4
The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
shortcodes-ultimate-pro
Fixed in
7.2.1
What to do
Update shortcodes-ultimate-pro to 7.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2024Essential Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-5595 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Essential Blocks
Fixed in
4.7.0
What to do
Update Essential Blocks to 4.7.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2024Ultimate Blocks: Does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embedCVE-2024-6362 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Ultimate Blocks
Fixed in
3.2.0
What to do
Update Ultimate Blocks to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 22, 2024Kimili Flash Embed: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37221 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Bester Kimili Flash Embed allows Stored XSS.This issue affects Kimili Flash Embed: from n/a through 2.5.3.
Product
Kimili Flash Embed
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Kimili Flash Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Sketchfab Embed: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37216 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rami Yushuvaev Sketchfab Embed allows Stored XSS.This issue affects Sketchfab Embed: from n/a through 1.5.
Product
Sketchfab Embed
Affected
up to 1.5
What to do
Affects up to 1.5. Update Sketchfab Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024Power BI Embedded for: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37959 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Atlas Public Policy Power BI Embedded for WordPress allows Stored XSS.This issue affects Power BI Embedded for WordPress: from n/a through 1.1.7.
Product
Power BI Embedded for
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Power BI Embedded for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024CodePen Embedded Pens Shortcode: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37960 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Chris Coyier CodePen Embedded Pens Shortcode allows Stored XSS.This issue affects CodePen Embedded Pens Shortcode: from n/a through 1.0.0.
Product
CodePen Embedded Pens Shortcode
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update CodePen Embedded Pens Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 15, 2024Insert or Embed Articulate Content into: Does not prevent authors from uploading arbitrary files to the siteCVE-2024-5630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
Product
Insert or Embed Articulate Content into
Fixed in
4.3000000024
What to do
Update Insert or Embed Articulate Content into to 4.3000000024 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Embed Peertube Playlist: Does not sanitise and escape some of its settingsCVE-2024-4602 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Embed Peertube Playlist WordPress plugin before 1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Embed Peertube Playlist
Fixed in
1.10
What to do
Update Embed Peertube Playlist to 1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024OpenPGP Form Encryption for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3919 · WordPress plugins & themes · reported by WPScanMedium 4.6
The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
OpenPGP Form Encryption for
Fixed in
1.5.1
What to do
Update OpenPGP Form Encryption for to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Website Content in Page or Post: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2430 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Website Content in Page or Post
Fixed in
2024.04.09
What to do
Update Website Content in Page or Post to 2024.04.09 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2024Bible Text: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5444 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Bible Text
Affected
up to 0.2
What to do
Affects up to 0.2. Update Bible Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-4655 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Ultimate Blocks
Fixed in
3.1.9
What to do
Update Ultimate Blocks to 3.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 1, 2024Quiz and Survey Master (QSM): Does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embedCVE-2024-4934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Quiz and Survey Master (QSM)
Fixed in
9.0.2
What to do
Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 26, 2024Spotify Play Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5199 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Spotify Play Button
Affected
up to 1.0
What to do
Affects up to 1.0. Update Spotify Play Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024EmbedPress: Missing AuthorizationCVE-2023-51375 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.8.3.
Product
EmbedPress
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5448 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
Affected
up to 1.7
What to do
Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024DOP Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-4377 · WordPress plugins & themes · reported by WPScanMedium 5.4
The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
DOP Shortcodes
Affected
up to 1.2
What to do
Affects up to 1.2. Update DOP Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2024Responsive video embed: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5475 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive video embed
Fixed in
0.5.1
What to do
Update Responsive video embed to 0.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2024EmbedSocial – Social Media Feeds, Reviews and Galleries: Stored Cross-Site ScriptingCVE-2024-3984 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedSocial – Social Media Feeds, Reviews and Galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedsocial_reviews' shortcode in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
EmbedSocial – Social Media Feeds, Reviews and Galleries
Affected
up to 1.1.29
What to do
Affects up to 1.1.29. Update EmbedSocial – Social Media Feeds, Reviews and Galleries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 17, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-4305 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Post Grid Gutenberg Blocks and WordPress Blog
Fixed in
4.1.0
What to do
Update Post Grid Gutenberg Blocks and WordPress Blog to 4.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2024WordPress Jitsi Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3978 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WordPress Jitsi Shortcode
Affected
up to 0.1
What to do
Affects up to 0.1. Update WordPress Jitsi Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2024The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerableCVE-2024-1565 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the PDF Widget URL in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2024Tagembed: Missing AuthorizationCVE-2024-34804 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Tagembed.This issue affects Tagembed: from n/a through 5.8.
Product
Tagembed
Affected
up to 5.8
What to do
Affects up to 5.8. Update Tagembed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024EmbedPress: Missing AuthorizationCVE-2024-31284 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.9.8.
Product
EmbedPress
Affected
up to 3.9.8
What to do
Affects up to 3.9.8. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024EmbedPress: Missing AuthorizationCVE-2024-31274 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.9.11.
Product
EmbedPress
Affected
up to 3.9.11
What to do
Affects up to 3.9.11. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 5, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-5571 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the plugin's EmbedPress PDF widget in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024Insert or Embed Articulate Content into: Lacks validation of URLsCVE-2024-0756 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page.
Product
Insert or Embed Articulate Content into
Affected
up to 4.3000000023
What to do
Affects up to 4.3000000023. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024Gutenberg Blocks with AI by Kadence WP: Does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embedCVE-2024-4057 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenberg Blocks with AI by Kadence WP
Fixed in
3.2.37
What to do
Update Gutenberg Blocks with AI by Kadence WP to 3.2.37 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024Insert or Embed Articulate Content into: Is not properly filteringCVE-2024-0757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files
Product
Insert or Embed Articulate Content into
Affected
up to 4.3000000023
What to do
Affects up to 4.3000000023. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-1803 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of functionality due to insufficient authorization validation on the PDF embed block in all versions up to, and including, 3.9.12. This makes it possible for authenticated attackers, with contributor-level access and above, to embed PDF blocks.
Affected
up to 3.9.12
What to do
Affects up to 3.9.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3241 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Ultimate Blocks
Fixed in
3.1.7
What to do
Update Ultimate Blocks to 3.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress iCVE-2024-4316 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.9.16
What to do
Affects up to 3.9.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Post Grid Gutenberg Blocks and WordPress Blog
Fixed in
4.0.2
What to do
Update Post Grid Gutenberg Blocks and WordPress Blog to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 20243D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34561 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Stored XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.71.
Product
3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook
Affected
up to 3.71
What to do
Affects up to 3.71. Update 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Embed Google Fonts: Missing AuthorizationCVE-2024-33925 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adrian Mörchen Embed Google Fonts.This issue affects Embed Google Fonts: from n/a through 3.1.0.
Product
Embed Google Fonts
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Embed Google Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Carousel Slider: Does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embedCVE-2024-3703 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
Product
Carousel Slider
Fixed in
2.2.10
What to do
Update Carousel Slider to 2.2.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 3, 2024Gutenverse: Does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embedCVE-2024-3692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenverse
Fixed in
1.9.1
What to do
Update Gutenverse to 1.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2024Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms: Stored Cross-Site ScriptingCVE-2024-2542 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32527 is likely a duplicate of this issue.
Product
Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 29, 2024Google Doc Embedder: Server Side Request ForgeryCVE-2024-0216 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Google Doc Embedder
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Google Doc Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Fixed in
7.1.0
What to do
Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024MM-email2image: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3075 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
MM-email2image
Affected
up to 0.2.5
What to do
Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2159 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Social Sharing
Fixed in
3.3.61
What to do
Update Social Sharing to 3.3.61 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2024Embed Google Photos album: Server-Side Request Forgery (SSRF)CVE-2024-32775 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Pavex Embed Google Photos album.This issue affects Embed Google Photos album: from n/a through 2.1.9.
Product
Embed Google Photos album
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Embed Google Photos album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 20243D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Reflected XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.62.
Product
3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook
Affected
up to 3.62
What to do
Affects up to 3.62. Update 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Tagembed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32561 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tagembed allows Stored XSS.This issue affects Tagembed: from n/a through 4.7.
Product
Tagembed
Affected
up to 4.7
What to do
Affects up to 4.7. Update Tagembed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Kimili Flash Embed: Cross-Site Request Forgery (CSRF)CVE-2024-32092 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Michael Bester Kimili Flash Embed.This issue affects Kimili Flash Embed: from n/a through 2.5.3.
Product
Kimili Flash Embed
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Kimili Flash Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.