Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

404 results · page 5 of 9

Jul 20, 2024Responsive Mobile: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37949 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive Mobile allows Stored XSS.This issue affects Responsive Mobile: from n/a through 1.15.1.
Product
Responsive Mobile
Affected
up to 1.15.1
What to do
Affects up to 1.15.1. Update Responsive Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 6, 2024Responsive Image Gallery, Gallery Album: Missing AuthorizationCVE-2024-37542 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Product
Responsive Image Gallery, Gallery Album
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 20, 2024Responsive video embed: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5475 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive video embed
Fixed in
0.5.1
What to do
Update Responsive video embed to 0.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 17, 2024Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-4375 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_layer' shortcode in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the 'css_id' user supplied attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. e CVE-2024-37222 may be a duplicate of this issue.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024Simple Sitemap – Create a Responsive HTML Sitemap: Cross-Site Request ForgeryCVE-2023-6492 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'admin_notices' hook found in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a default state via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Simple Sitemap – Create a Responsive HTML Sitemap
Affected
up to 3.5.13
What to do
Affects up to 3.5.13. Update Simple Sitemap – Create a Responsive HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2024Slider Responsive Slideshow – Image slider, Gallery slideshow: Missing AuthorizationCVE-2024-35722 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: from n/a through 1.4.0.
Product
Slider Responsive Slideshow – Image slider, Gallery slideshow
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Slider Responsive Slideshow – Image slider, Gallery slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: Missing AuthorizationCVE-2024-35721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through 1.4.5.
Product
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Responsive Lightbox: Missing AuthorizationCVE-2024-31252 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in dFactory Responsive Lightbox.This issue affects Responsive Lightbox: from n/a through 2.4.6.
Product
Responsive Lightbox
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Responsive Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Responsive Image Gallery, Gallery Album: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-35750 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Product
Responsive Image Gallery, Gallery Album
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35731 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Moose Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor allows Stored XSS.This issue affects Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor: from n/a through 1.3.9.
Product
Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 6, 2024WP Mobile Menu – The Mobile-Friendly Responsive Menu: Stored Cross-Site ScriptingCVE-2024-3987 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Mobile Menu – The Mobile-Friendly Responsive Menu
Affected
up to 2.8.4.2
What to do
Affects up to 2.8.4.2. Update WP Mobile Menu – The Mobile-Friendly Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 5, 2024Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme.: Stored Cross-Site ScriptingCVE-2024-5222 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme.
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024Responsive: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35654 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive allows Stored XSS.This issue affects Responsive: from n/a through 5.0.3.
Product
Responsive
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Responsive Slick Slider: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-49852 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vsourz Digital Responsive Slick Slider WordPress allows Code Injection.This issue affects Responsive Slick Slider WordPress: from n/a through 1.4.
Product
Responsive Slick Slider
Affected
up to 1.4
What to do
Affects up to 1.4. Update Responsive Slick Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Responsive Tabs: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-45635 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injection.This issue affects Responsive Tabs: from n/a before 4.0.6.
Product
Responsive Tabs
Fixed in
4.0.6
What to do
Update Responsive Tabs to 4.0.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 1, 2024Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2023-6382 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide' shortcode in all versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied 'css_class' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.9
What to do
Affects up to 3.9.9. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2024Responsive Owl Carousel for Elementor: Local File InclusionCVE-2024-5345 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Responsive Owl Carousel for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.0 via the layout parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The inclusion is limited to PHP files.
Product
Responsive Owl Carousel for Elementor
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Responsive Owl Carousel for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024Responsive Contact Form Builder & Lead Generation: Arbitrary shortcode executionCVE-2024-4261 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Product
Responsive Contact Form Builder & Lead Generation
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2024Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-4470 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide_info' shortcode in all versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied 'tag_name' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.9
What to do
Affects up to 3.9.9. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 18, 2024Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete opCVE-2024-28064 · Other software · kiteworks · reported by MITRECritical 9.8
Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages).
Product
totemomail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record objectif-securite.ch objectif-securite.ch
May 18, 2024Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS.CVE-2024-28063 · Other software · kiteworks · reported by MITREMedium 6.1
Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS.
Product
totemomail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record objectif-securite.ch objectif-securite.ch
May 14, 2024Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, claCVE-2024-4824 · Other software · AROX SOLUTION · reported by cve-coordination@incibe.esCritical 9.8
Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, classes_id, es_voucherid, es_class, etc. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the database.
Product
School ERP Pro+Responsive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
May 14, 2024Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index '/schoolerp/office_admin/' in the parameters es_bankacc, es_bank_name, es_bank_pin,CVE-2024-4823 · Other software · AROX SOLUTION · reported by cve-coordination@incibe.esMedium 6.5
Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index '/schoolerp/office_admin/' in the parameters es_bankacc, es_bank_name, es_bank_pin, es_checkno, es_teller_number, dc1 and dc2. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.
Product
School ERP Pro+Responsive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
May 14, 2024Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'.CVE-2024-4822 · Other software · AROX SOLUTION · reported by cve-coordination@incibe.esMedium 6.5
Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability allows an attacker to partially take control of the victim's browser session.
Product
School ERP Pro+Responsive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
May 3, 2024Slider Carousel – Responsive Image Slider: Missing AuthorizationCVE-2023-25457 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Richteam Slider Carousel – Responsive Image Slider.This issue affects Slider Carousel – Responsive Image Slider: from n/a through 1.5.1.
Product
Slider Carousel – Responsive Image Slider
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Slider Carousel – Responsive Image Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Responsive Contact Form Builder & Lead Generation: Does not sanitise and escape some of its settingsCVE-2024-3637 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Responsive Contact Form Builder & Lead Generation
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2024Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery: PHP Object InjectionCVE-2024-1896 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.2 via deserialization via shortcode of untrusted input from the 'awl_lg_settings_' attribute. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Responsive Contact Form Builder & Lead Generation: Unauthorized access to functionalityCVE-2024-1416 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on several functions in all versions up to, and including, 1.8.9. This makes it possible for unauthenticated attackers to invoke those functions.
Product
Responsive Contact Form Builder & Lead Generation
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Responsive Contact Form Builder & Lead Generation: Cross-Site Request ForgeryCVE-2024-1415 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.9. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. These actions may result in form deletion, and lead signup as well as file upload.
Product
Responsive Contact Form Builder & Lead Generation
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 18, 2024Ovic Responsive WPBakery: Missing AuthorizationCVE-2024-32142 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ovic Team Ovic Responsive WPBakery.This issue affects Ovic Responsive WPBakery: from n/a through 1.3.0.
Product
Ovic Responsive WPBakery
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Ovic Responsive WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Responsive Tabs: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1846 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Tabs
Fixed in
4.0.7
What to do
Update Responsive Tabs to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2024Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows: Stored Cross-Site ScriptingCVE-2024-3285 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'metaslider' shortcode in all versions up to, and including, 3.70.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows
Affected
up to 3.70.0
What to do
Affects up to 3.70.0. Update Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024WP Responsive Tabs horizontal vertical and accordion Tabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27989 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs allows Stored XSS.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs: from n/a through 1.1.17.
Product
WP Responsive Tabs horizontal vertical and accordion Tabs
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update WP Responsive Tabs horizontal vertical and accordion Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WEN Responsive Columns: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2.
Product
WEN Responsive Columns
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WEN Responsive Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-1664 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Responsive Gallery Grid
Fixed in
2.3.11
What to do
Update Responsive Gallery Grid to 2.3.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 31, 2024Responsive flipbook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30552 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wppdf.Org Responsive flipbook allows Stored XSS.This issue affects Responsive flipbook: from n/a through 1.0.0.
Product
Responsive flipbook
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Responsive flipbook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Responsive Image Gallery, Gallery Album: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30550 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Reflected XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Product
Responsive Image Gallery, Gallery Album
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Responsive Image Gallery, Gallery Album: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31120 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Stored XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Product
Responsive Image Gallery, Gallery Album
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Creative Image Slider – Responsive Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30447 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Solutions Creative Image Slider – Responsive Slider Plugin allows Reflected XSS.This issue affects Creative Image Slider – Responsive Slider Plugin: from n/a through 2.1.3.
Product
Creative Image Slider – Responsive Slider
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Creative Image Slider – Responsive Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024WP Responsive Tabs horizontal vertical and accordion Tabs: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30497 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs: from n/a through 1.1.17.
Product
WP Responsive Tabs horizontal vertical and accordion Tabs
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update WP Responsive Tabs horizontal vertical and accordion Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Responsive: Unauthorized modification of dataCVE-2024-2848 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Responsive theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_footer_text_callback function in all versions up to, and including, 5.0.2. This makes it possible for unauthenticated attackers to inject arbitrary HTML content into the site's footer.
Product
Responsive
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Mar 29, 2024Lightbox slider – Responsive Lightbox Gallery: PHP Object InjectionCVE-2024-1858 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.9 via deserialization of untrusted input through post meta data. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Lightbox slider – Responsive Lightbox Gallery
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update Lightbox slider – Responsive Lightbox Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 18, 2024Responsive Pricing Table: Does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embedCVE-2024-1333 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Pricing Table
Fixed in
5.1.11
What to do
Update Responsive Pricing Table to 5.1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 2, 2024Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-1449 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slide shortcode in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the 'src' user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 2, 2024Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-0611 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slides callback functionality in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.9
What to do
Affects up to 3.9.9. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Mar 2, 2024Master Slider – Responsive Touch Slider: Cross-Site Request ForgeryCVE-2023-6326 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.10. This is due to missing or incorrect nonce validation on the 'process_bulk_action' function. This makes it possible for unauthenticated attackers to duplicate or delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-50900 and CVE-2024-6490 may be a duplicate of this issue.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2024Slider Responsive Slideshow – Image slider, Gallery slideshow: PHP Object InjectionCVE-2024-1859 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization of untrusted input to the awl_slider_responsive_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Slider Responsive Slideshow – Image slider, Gallery slideshow
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Slider Responsive Slideshow – Image slider, Gallery slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 21, 2024JTRT Responsive Tables: Cross-Site Request Forgery (CSRF)CVE-2024-24802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in John Tendik JTRT Responsive Tables.This issue affects JTRT Responsive Tables: from n/a through 4.1.9.
Product
JTRT Responsive Tables
Affected
up to 4.1.9
What to do
Affects up to 4.1.9. Update JTRT Responsive Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Brooklyn | Creative Multi-Purpose Responsive: Deserialization of Untrusted DataCVE-2024-24926 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
Product
Brooklyn | Creative Multi-Purpose Responsive
Affected
up to 4.9.7.6
What to do
Affects up to 4.9.7.6. Update Brooklyn | Creative Multi-Purpose Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Brooklyn | Creative Multi-Purpose Responsive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24927 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme allows Reflected XSS.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
Product
Brooklyn | Creative Multi-Purpose Responsive
Affected
up to 4.9.7.6
What to do
Affects up to 4.9.7.6. Update Brooklyn | Creative Multi-Purpose Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.