Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,714entries in the database

652 results · page 5 of 14

Jun 8, 2024Import and export users and customers: Missing AuthorizationCVE-2024-22151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.
Product
Import and export users and customers
Affected
up to 1.24.6
What to do
Affects up to 1.24.6. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 7, 2024ARForms - Premium WordPress Form Builder: Allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploadedCVE-2024-4620 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form
Product
ARForms - Premium WordPress Form Builder
Fixed in
6.6
What to do
Update ARForms - Premium WordPress Form Builder to 6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 31, 2024WP STAGING WordPress Backup: Does not prevent users with the administrator role from pinging conducting SSRF attacksCVE-2024-4469 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
Product
WP STAGING WordPress Backup
Fixed in
3.5.0
What to do
Update WP STAGING WordPress Backup to 3.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2024The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attackCVE-2024-4399 · WordPress plugins & themes · reported by WPScanCritical 9.1
The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Import and export users and customers: Stored Cross-Site ScriptingCVE-2024-4734 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Import and export users and customers
Affected
up to 1.26.6.1
What to do
Affects up to 1.26.6.1. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Import and export users and customers: Stored Cross-Site ScriptingCVE-2024-4656 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Import and export users and customers
Affected
up to 1.26.6.1
What to do
Affects up to 1.26.6.1. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 4, 2024Import and export users and customers: Unauthorized modification of dataCVE-2024-1050 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. CVE-2024-34815 is a duplicate of this issue.
Product
Import and export users and customers
Affected
up to 1.26.5
What to do
Affects up to 1.26.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 4, 2024Stop Spammers Security | Block Spam Users, Comments, Forms: Cross-Site Request ForgeryCVE-2023-7065 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfs_process AJAX action. This makes it possible for unauthenticated attackers to add arbitrary IPs to the plugin's allowlist and blocklist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Affected
up to 2024.4
What to do
Affects up to 2024.4. Update Stop Spammers Security | Block Spam Users, Comments, Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2024Import Export WordPress Users: Deserialization of Untrusted DataCVE-2024-32835 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3.
Product
Import Export WordPress Users
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Import Export WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Import and export users and customers: Deserialization of Untrusted DataCVE-2024-32817 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.2.
Product
Import and export users and customers
Affected
up to 1.26.2
What to do
Affects up to 1.26.2. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Import WP: Does not prevent users with the administrator role from pinging conducting SSRF attacksCVE-2023-7253 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
Product
Import WP
Fixed in
2.13.1
What to do
Update Import WP to 2.13.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 22, 2024Tickera: Does not prevent users from leaking other users' ticketsCVE-2023-7252 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets.
Product
Tickera
Fixed in
3.5.2.5
What to do
Update Tickera to 3.5.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Import Users from CSV: Deserialization of Untrusted DataCVE-2024-32431 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2.
Product
Import Users from CSV
Affected
up to 1.2
What to do
Affects up to 1.2. Update Import Users from CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URLCVE-2024-1849 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URL
Product
WP Customer Reviews
Fixed in
3.7.1
What to do
Update WP Customer Reviews to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024WooCommerce: Does not prevent users with at least the contributor role from leaking products they shouldn't have access toCVE-2024-1310 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
Product
WooCommerce
Fixed in
8.6
What to do
Update WooCommerce to 8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Meta Box: Does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's postsCVE-2024-1204 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
Product
Meta Box
Fixed in
5.9.4
What to do
Update Meta Box to 5.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 13, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not properly escape some of its shortcodes attributes before they are echoed back to usersCVE-2024-2583 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Fixed in
7.0.5
What to do
Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2024UsersWP: Cross-Site Request Forgery (CSRF)CVE-2024-31936 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a before 1.2.6.
Product
UsersWP
Fixed in
1.2.6
What to do
Update UsersWP to 1.2.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Inline Related Posts: Is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayedCVE-2023-6257 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts
Product
Inline Related Posts
Fixed in
3.6.0
What to do
Update Inline Related Posts to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 9, 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Stored Cross-Site ScriptingCVE-2024-2423 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perforCVE-2024-2278 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Fixed in
1.4.4
What to do
Update the plugin to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filtersCVE-2024-2262 · WordPress plugins & themes · reported by WPScanMedium 4.7
Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs
Fixed in
1.4.4
What to do
Update the plugin to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 29, 2024Import Export WordPress Users: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-30492 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.
Product
Import Export WordPress Users
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Import Export WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Pz-LinkCard: Does not prevent users from pinging arbitrary hosts via some of its shortcodesCVE-2024-0677 · WordPress plugins & themes · reported by WPScanMedium 5.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
Product
Pz-LinkCard
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 26, 2024Front End Users: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-33322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Front End Users allows Reflected XSS.This issue affects Front End Users: from n/a before 3.2.25.
Product
Front End Users
Fixed in
3.2.25
What to do
Update Front End Users to 3.2.25 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 11, 2024User Registration: Does not prevent users with at least the contributor role from rendering sensitive shortcodesCVE-2024-1290 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.
Product
User Registration
Fixed in
2.12
What to do
Update User Registration to 2.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2024Paid Memberships Pro: Does not prevent user with at least the contributor role from leaking other users' sensitive metadataCVE-2024-1279 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata.
Product
Paid Memberships Pro
Fixed in
2.12.9
What to do
Update Paid Memberships Pro to 2.12.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2024Login as User or Customer: Does not prevent users to log inCVE-2023-7247 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
Product
Login as User or Customer
Affected
up to 3.8
What to do
Affects up to 3.8. Update Login as User or Customer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record drive.google.com wpscan.com
Mar 4, 2024Events Tickets Plus: Does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of statusCVE-2024-1319 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
Product
Events Tickets Plus
Fixed in
5.9.1
What to do
Update Events Tickets Plus to 5.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 4, 2024Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus: Does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access toCVE-2024-1316 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).
Product
Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus
Fixed in
5.8.1
What to do
Update Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus to 5.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2024Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 29, 2024WordPress Users: Does not have CSRF check in placeCVE-2023-6390 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
WordPress Users
Affected
up to 1.4
What to do
Affects up to 1.4. Update WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 16, 2024WP Customer Area: Does not properly validate users capabilities in some of its AJAX actionsCVE-2023-6741 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.
Product
WP Customer Area
Fixed in
8.2.1
What to do
Update WP Customer Area to 8.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Royal Elementor Addons and Templates: Does not ensure that users accessing posts via an AJAX action (and REST endpointCVE-2023-5922 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content
Product
Royal Elementor Addons and Templates
Fixed in
1.3.81
What to do
Update Royal Elementor Addons and Templates to 1.3.81 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
WordPress Database Administrator
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (suchCVE-2022-1538 · WordPress plugins & themes · reported by WPScanHigh 7.2
Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed.
Fixed in
1.1.1
What to do
Update the plugin to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 11, 2024Import and export users and customers: Stored Cross-Site ScriptingCVE-2023-6624 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Import and export users and customers
Affected
up to 1.24.3
What to do
Affects up to 1.24.3. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Import and export users and customers: Directory TraversalCVE-2023-6583 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.
Product
Import and export users and customers
Affected
up to 1.24.2
What to do
Affects up to 1.24.2. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Export and Import Users and Customers: Arbitrary file uploadsCVE-2023-6558 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Export and Import Users and Customers
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 8, 2024Slider Revolution: Does not prevent users with at least the Author role from unserializing arbitrary contentCVE-2023-6528 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution.
Product
Slider Revolution
Fixed in
6.6.19
What to do
Update Slider Revolution to 6.6.19 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Essential Real Estate: Does not prevent users with limited privileges on the siteCVE-2023-6140 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from momentarily uploading malicious PHP files disguised as ZIP archives, which may lead to remote code execution.
Product
Essential Real Estate
Fixed in
4.4.0
What to do
Update Essential Real Estate to 4.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 5, 2024Send Users Email: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52126 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email.This issue affects Send Users Email: from n/a through 1.4.3.
Product
Send Users Email
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Send Users Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51675 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.15
What to do
Affects up to 6.9.15. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 27, 2023Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site.CVE-2023-51700 · WordPress plugins & themes · reported by GitHubMedium 6.4
Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts.
Fixed in
1.0.1
What to do
Update the plugin to 1.0.1 or newer.
Full record and what to do →NVD record github.com github.com
Dec 26, 2023The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tagCVE-2023-6250 · WordPress plugins & themes · reported by WPScanHigh 7.5
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag
Product
BestWebSoft's Like & Share
Fixed in
2.74
What to do
Update BestWebSoft's Like & Share to 2.74 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2023Export All Posts, Products, Orders, Refunds & Users: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-2487 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023User Submitted Posts – Enable Users to Submit Posts from the Front End: Unrestricted Upload of File with Dangerous TypeCVE-2023-45603 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts – Enable Users to Submit Posts from the Front End: from n/a through 20230902.
Product
User Submitted Posts – Enable Users to Submit Posts from the Front End
Affected
up to 20230902
What to do
Affects up to 20230902. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Swift Performance Lite: Does not prevent users from exporting the plugin's settingsCVE-2023-6289 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
Product
Swift Performance Lite
Fixed in
2.3.6.15
What to do
Update Swift Performance Lite to 2.3.6.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perfCVE-2023-6222 · WordPress plugins & themes · reported by WPScanHigh 7.2
IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks
Fixed in
3.4.2.1
What to do
Update the plugin to 3.4.2.1 or newer.
Full record and what to do →NVD record drive.google.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.