Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

427 results · page 5 of 9

Mar 24, 2025Advanced Dewplayer: Missing AuthorizationCVE-2025-30592 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal Advanced Dewplayer advanced-dewplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Dewplayer: from n/a through <= 1.6.
Product
Advanced Dewplayer
Affected
up to 1.6
What to do
Affects up to 1.6. Update Advanced Dewplayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Qubely – Advanced Gutenberg Blocks: Sensitive Information ExposureCVE-2024-13228 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data.
Product
Qubely – Advanced Gutenberg Blocks
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update Qubely – Advanced Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025Advanced File Manager — Ultimate WordPress File Manager and Document Library: Stored Cross-Site ScriptingCVE-2024-13805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Advanced File Manager — Ultimate WordPress File Manager and Document Library
Affected
up to 5.2.14
What to do
Affects up to 5.2.14. Update Advanced File Manager — Ultimate WordPress File Manager and Document Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025Advanced AJAX Product Filters: Reflected Cross-Site ScriptingCVE-2025-1505 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Advanced AJAX Product Filters
Affected
up to 1.6.8.1
What to do
Affects up to 1.6.8.1. Update Advanced AJAX Product Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 25, 2025Advanced Google reCaptcha: CAPTCHA BypassCVE-2025-1262 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
Product
Advanced Google reCaptcha
Affected
up to 1.27
What to do
Affects up to 1.27. Update Advanced Google reCaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included: Stored Cross-Site ScriptingCVE-2024-11335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframe' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 15, 2025Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive: Server-Side Request ForgeryCVE-2024-13834 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remote_request' function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2025Advanced Angular Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23658 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form advanced-angular-contact-form allows Reflected XSS.This issue affects Advanced Angular Contact Form: from n/a through <= 1.1.0.
Product
Advanced Angular Contact Form
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Advanced Angular Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Qubely – Advanced Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2024-9601 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-26767 is a duplicate of this issue.
Product
Qubely – Advanced Gutenberg Blocks
Affected
up to 1.8.12
What to do
Affects up to 1.8.12. Update Qubely – Advanced Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 13, 2025TinyMCE Advanced qTranslate fix editor problems: Cross-Site Request Forgery (CSRF)CVE-2025-26582 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems allows Stored XSS.This issue affects TinyMCE Advanced qTranslate fix editor problems: from n/a through <= 1.0.0.
Product
TinyMCE Advanced qTranslate fix editor problems
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update TinyMCE Advanced qTranslate fix editor problems to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025Advanced Dynamic Pricing for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24632 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Reflected XSS.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through <= 4.9.0.
Product
Advanced Dynamic Pricing for WooCommerce
Affected
up to 4.9.0
What to do
Affects up to 4.9.0. Update Advanced Dynamic Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Advanced Notifications: Missing AuthorizationCVE-2025-24693 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Yehi Advanced Notifications advanced-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Notifications: from n/a through <= 1.2.7.
Product
Advanced Notifications
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Advanced Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Mapbox for WP Advanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22772 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stephanemartinw Mapbox for WP Advanced mapbox-for-wp-advanced allows Reflected XSS.This issue affects Mapbox for WP Advanced: from n/a through <= 1.0.0.
Product
Mapbox for WP Advanced
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Mapbox for WP Advanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 17, 2025Advanced File Manager: Arbitrary file uploadsCVE-2024-13333 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' function in versions 5.2.12 to 5.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above and upload permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The function can be exploited only if the "Display .htaccess?" setting is enabled.
Product
Advanced File Manager
Affected
5.2.12 to 5.2.13
What to do
Affects 5.2.12 to 5.2.13. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2025Gallery: Hybrid – Advanced Visual Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23951 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DIVENGINE Gallery: Hybrid – Advanced Visual Gallery hybrid-gallery allows Stored XSS.This issue affects Gallery: Hybrid – Advanced Visual Gallery: from n/a through <= 1.4.0.2.
Product
Gallery: Hybrid – Advanced Visual Gallery
Affected
up to 1.4.0.2
What to do
Affects up to 1.4.0.2. Update Gallery: Hybrid – Advanced Visual Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Enhanced YouTube Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Le-Pixel-Solitaire Enhanced YouTube Shortcode enhanced-youtube-shortcode allows Stored XSS.This issue affects Enhanced YouTube Shortcode: from n/a through <= 2.0.1.
Product
Enhanced YouTube Shortcode
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Enhanced YouTube Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Visit Site Link enhanced: Cross-Site Request Forgery (CSRF)CVE-2025-23470 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Link enhanced: from n/a through <= 1.0.
Product
Visit Site Link enhanced
Affected
up to 1.0
What to do
Affects up to 1.0. Update Visit Site Link enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Scroll Top Advanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23444 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Scroll Top Advanced scroll-top-advanced allows Stored XSS.This issue affects Scroll Top Advanced: from n/a through <= 2.5.
Product
Scroll Top Advanced
Affected
up to 2.5
What to do
Affects up to 2.5. Update Scroll Top Advanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025Advanced Product Information for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce woo-advanced-product-information allows Stored XSS.This issue affects Advanced Product Information for WooCommerce: from n/a through <= 1.1.4.
Product
Advanced Product Information for WooCommerce
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Advanced Product Information for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22352 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Blind SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.
Product
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Advanced Form Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56293 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Stored XSS.This issue affects Advanced Form Integration: from n/a through <= 1.95.0.
Product
Advanced Form Integration
Affected
up to 1.95.0
What to do
Affects up to 1.95.0. Update Advanced Form Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2024Advanced Floating Content: SQL InjectionCVE-2024-12031 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Advanced Floating Content plugin for WordPress is vulnerable to SQL Injection via the 'floating_content_duplicate_post' function in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Advanced Floating Content
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update Advanced Floating Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Dec 24, 2024Advanced Google reCAPTCHA: IP unblockingCVE-2024-12034 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts
Product
Advanced Google reCAPTCHA
Affected
up to 1.25
What to do
Affects up to 1.25. Update Advanced Google reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2024Advanced Options Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54249 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Advanced Options Editor allows Reflected XSS.This issue affects Advanced Options Editor: from n/a through 1.0.
Product
Advanced Options Editor
Affected
up to 1.0
What to do
Affects up to 1.0. Update Advanced Options Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Advanced What should we write next about: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55987 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows SQL Injection.This issue affects Advanced What should we write next about: from n/a through <= 1.0.3.
Product
Advanced What should we write next about
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Advanced What should we write next about to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Advanced Data Table For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54443 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Advanced Data Table For Elementor advanced-data-table-for-elementor allows Stored XSS.This issue affects Advanced Data Table For Elementor: from n/a through <= 1.0.0.
Product
Advanced Data Table For Elementor
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Advanced Data Table For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Advanced Fancybox: Cross-Site Request Forgery (CSRF)CVE-2024-54401 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Turcu Advanced Fancybox advanced-fancybox allows Stored XSS.This issue affects Advanced Fancybox: from n/a through <= 1.1.1.
Product
Advanced Fancybox
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Advanced Fancybox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Advanced Custom Fields PRO: Cross-Site Request Forgery (CSRF)CVE-2024-37251 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3.2.
Product
Advanced Custom Fields PRO
Fixed in
6.3.2
What to do
Update Advanced Custom Fields PRO to 6.3.2 or newer.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Advanced Blog Post Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54287 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through <= 1.0.4.
Product
Advanced Blog Post Block
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Advanced Blog Post Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Advanced Control Manager for WordPress by ItalyStrap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54233 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Reflected XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through <= 2.16.0.
Product
Advanced Control Manager for WordPress by ItalyStrap
Affected
up to 2.16.0
What to do
Affects up to 2.16.0. Update Advanced Control Manager for WordPress by ItalyStrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024LiquidPoll – Advanced Polls for Creators and Brands: Missing AuthorizationCVE-2023-36531 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.68.
Product
LiquidPoll – Advanced Polls for Creators and Brands
Affected
up to 3.3.68
What to do
Affects up to 3.3.68. Update LiquidPoll – Advanced Polls for Creators and Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Enhanced Text Widget: Missing AuthorizationCVE-2023-49192 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cl272 Enhanced Text Widget enhanced-text-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through <= 1.6.3.
Product
Enhanced Text Widget
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Enhanced Text Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Advanced Text Widget: Missing AuthorizationCVE-2023-26520 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Max Chirkov Advanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Text Widget : from n/a through 2.1.2.
Product
Advanced Text Widget
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Advanced Text Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Enhanced Text Widget: Missing AuthorizationCVE-2023-23823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through 1.5.8.
Product
Enhanced Text Widget
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Enhanced Text Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024Advanced Element Bucket Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54210 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codexshaper Advanced Element Bucket Addons for Elementor cs-element-bucket allows Stored XSS.This issue affects Advanced Element Bucket Addons for Elementor: from n/a through <= 1.0.2.
Product
Advanced Element Bucket Addons for Elementor
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Advanced Element Bucket Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 3, 2024Advanced File Manager: Arbitrary file uploadsCVE-2024-11391 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Advanced File Manager
Affected
up to 5.2.10
What to do
Affects up to 5.2.10. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 2, 2024Advanced What should we write next about: Cross-Site Request Forgery (CSRF)CVE-2024-53789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows Stored XSS.This issue affects Advanced What should we write next about: from n/a through <= 1.0.3.
Product
Advanced What should we write next about
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Advanced What should we write next about to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 2, 2024Advanced Event Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53721 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stachethemes Advanced Event Manager advanced-event-manager allows Stored XSS.This issue affects Advanced Event Manager: from n/a through <= 1.1.6.
Product
Advanced Event Manager
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Advanced Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Advanced Video Player with Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51824 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Karam Singh Advanced Video Player with Analytics advanced-video-player-with-analytics allows DOM-Based XSS.This issue affects Advanced Video Player with Analytics: from n/a through <= 1.
Product
Advanced Video Player with Analytics
Affected
up to 1
What to do
Affects up to 1. Update Advanced Video Player with Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Advanced PDF Generator: Cross-Site Request Forgery (CSRF)CVE-2024-51641 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Juan Camilo Advanced PDF Generator advanced-pdf-generator allows Stored XSS.This issue affects Advanced PDF Generator: from n/a through <= 0.4.0.
Product
Advanced PDF Generator
Affected
up to 0.4.0
What to do
Affects up to 0.4.0. Update Advanced PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Advanced Control Manager for WordPress by ItalyStrap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Stored XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through <= 2.16.0.
Product
Advanced Control Manager for WordPress by ItalyStrap
Affected
up to 2.16.0
What to do
Affects up to 2.16.0. Update Advanced Control Manager for WordPress by ItalyStrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 16, 2024Advanced Personalization: Deserialization of Untrusted DataCVE-2024-52411 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in flowcraft Advanced Personalization personalization-by-flowcraft allows Object Injection.This issue affects Advanced Personalization: from n/a through <= 1.1.2.
Product
Advanced Personalization
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Advanced Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 15, 2024The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin beforeCVE-2024-9529 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
Fixed in
6.3.9
What to do
Update the plugin to 6.3.9 or newer.
Full record and what to do →NVD record wpscan.com
Nov 12, 2024Advanced Order Export For WooCommerce: PHP Object InjectionCVE-2024-10828 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Advanced Order Export For WooCommerce
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Advanced Order Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 9, 2024Fabrica Synced Pattern Instances: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yes We Work Fabrica Synced Pattern Instances fabrica-reusable-block-instances allows Reflected XSS.This issue affects Fabrica Synced Pattern Instances: from n/a through <= 1.0.8.
Product
Fabrica Synced Pattern Instances
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Fabrica Synced Pattern Instances to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Advanced Cron Manager – debug & control: Missing AuthorizationCVE-2024-43154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9.
Product
Advanced Cron Manager – debug & control
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update Advanced Cron Manager – debug & control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37250 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
Product
Advanced Custom Fields PRO
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Advanced Custom Fields PRO: Missing AuthorizationCVE-2024-37249 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
Product
Advanced Custom Fields PRO
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update Advanced Custom Fields PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024DarkMySite – Advanced Dark Mode Plugin for: Cross-Site Request Forgery (CSRF)CVE-2024-50466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite – Advanced Dark Mode Plugin for WordPress: from n/a through 1.2.8.
Product
DarkMySite – Advanced Dark Mode Plugin for
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update DarkMySite – Advanced Dark Mode Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024Advanced Sermons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50458 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored XSS.This issue affects Advanced Sermons: from n/a through <= 3.4.
Product
Advanced Sermons
Affected
up to 3.4
What to do
Affects up to 3.4. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.