Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

38added in the last 30 days

561new WordPress flaws this week

398,769entries in the database

41,498 results · page 517 of 830

Oct 16, 2024Telecash Ricaricaweb: Deserialization of Untrusted DataCVE-2024-48030 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through <= 2.2.
Product
Telecash Ricaricaweb
Affected
up to 2.2
What to do
Affects up to 2.2. Update Telecash Ricaricaweb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024SB Random Posts Widget: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-48029 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget sb-random-posts-widget allows PHP Local File Inclusion.This issue affects SB Random Posts Widget: from n/a through <= 1.0.
Product
SB Random Posts Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update SB Random Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024IP Loc8: Deserialization of Untrusted DataCVE-2024-48028 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 ip-loc8 allows Object Injection.This issue affects IP Loc8: from n/a through <= 1.1.
Product
IP Loc8
Affected
up to 1.1
What to do
Affects up to 1.1. Update IP Loc8 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024External featured image from bing: Unrestricted Upload of File with Dangerous TypeCVE-2024-48027 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in xaraartech External featured image from bing external-featured-image-from-bing allows Upload a Web Shell to a Web Server.This issue affects External featured image from bing: from n/a through <= 1.0.2.
Product
External featured image from bing
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update External featured image from bing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Disc Golf Manager: Deserialization of Untrusted DataCVE-2024-48026 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through <= 1.0.0.
Product
Disc Golf Manager
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Disc Golf Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Iconize: Unrestricted Upload of File with Dangerous TypeCVE-2024-47649 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in THATplugin Iconize iconize.This issue affects Iconize: from n/a through <= 1.2.4.
Product
Iconize
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Iconize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Top Bar – PopUps – by WPOptin: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47645 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows PHP Local File Inclusion.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.1.
Product
Top Bar – PopUps – by WPOptin
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Top Bar – PopUps – by WPOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024LiteSpeed Cache: Relative Path TraversalCVE-2024-47637 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.
Product
LiteSpeed Cache
Affected
up to 6.4.1
What to do
Affects up to 6.4.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024MaxSlider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47351 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.This issue affects MaxSlider: from n/a through <= 1.2.3.
Product
MaxSlider
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update MaxSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Deserialization of Untrusted DataCVE-2024-49271 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.121.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.121
What to do
Affects up to 1.5.121. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Azz Anonim Posting: Unrestricted Upload of File with Dangerous TypeCVE-2024-49257 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting azz-anonim-posting allows Upload a Web Shell to a Web Server.This issue affects Azz Anonim Posting: from n/a through <= 0.9.
Product
Azz Anonim Posting
Affected
up to 0.9
What to do
Affects up to 0.9. Update Azz Anonim Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024BuddyPress Better Registration: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49247 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in SK BuddyPress Better Registration better-bp-registration allows Authentication Bypass.This issue affects BuddyPress Better Registration: from n/a through <= 1.6.
Product
BuddyPress Better Registration
Affected
up to 1.6
What to do
Affects up to 1.6. Update BuddyPress Better Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Contact Form by Supsystic: Deserialization of Untrusted DataCVE-2024-48042 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
Product
Contact Form by Supsystic
Affected
up to 1.7.28
What to do
Affects up to 1.7.28. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024WooCommerce Smart Coupons: Authorization bypassCVE-2020-36841 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.
Product
WooCommerce Smart Coupons
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update WooCommerce Smart Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Oct 16, 2024Zita Elementor Site Library: Stored Cross-Site ScriptingCVE-2024-8921 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zita Elementor Site Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Zita Elementor Site Library
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Zita Elementor Site Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024ElementsReady Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-9444 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
ElementsReady Addons for Elementor
Affected
up to 6.4.3
What to do
Affects up to 6.4.3. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024Sina Extension for Elementor: Sensitive Information ExposureCVE-2024-9540 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.7 via the render function in widgets/advanced/sina-modal-box.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
Product
Sina Extension for Elementor
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Sina Extension for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024The WP Popup Builder – Popup Forms and Marketing Lead Generation: Arbitrary shortcode executionCVE-2024-9061 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. NOTE: This vulnerability was partially fixed in version 1.3.5 with a nonce check, which effectively prevented access to the affected function. However, version 1.3.6 incorporates the correct authorization check to prevent unauthorized access.
Product
The WP Popup Builder – Popup Forms and Marketing Lead Generation
Affected
up to 1.3.5
Fixed in
1.3.5
What to do
Update The WP Popup Builder – Popup Forms and Marketing Lead Generation to 1.3.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024BigBlueButton: Stored Cross-Site ScriptingCVE-2023-7296 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BigBlueButton plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the moderator code and viewer code fields in versions up to, and including, 3.0.0-beta.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with author privileges or higher to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
BigBlueButton
Affected
up to 3.0.0-beta.4
What to do
Affects up to 3.0.0-beta.4. Update BigBlueButton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Video Grid: Reflected Cross-Site ScriptingCVE-2023-7295 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Video Grid
Affected
up to 1.21
What to do
Affects up to 1.21. Update Video Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Google Language Translator: Reflected Cross-Site ScriptingCVE-2021-4452 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Specifically affects users with older browsers that lack proper URL encoding support.
Product
Google Language Translator
Affected
up to 6.0.9
What to do
Affects up to 6.0.9. Update Google Language Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024Migration, Backup, Staging – WPvivid: Arbitrary file uploadsCVE-2020-36842 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently extracted. This affects versions up to, and including 0.9.35.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.35
What to do
Affects up to 0.9.35. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org webarxsecurity.com
Oct 16, 2024Timetable and Event Schedule by MotoPress: Authorization bypassCVE-2020-36840 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.
Product
Timetable and Event Schedule by MotoPress
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Timetable and Event Schedule by MotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Formidable Form Builder: Sensitive Data ExposureCVE-2017-20194 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.
Product
Formidable Form Builder
Affected
up to 2.05.03
What to do
Affects up to 2.05.03. Update Formidable Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record klikki.fi wordfence.com
Oct 16, 2024The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufCVE-2017-20193 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected
up to 2.0.35
What to do
Affects up to 2.0.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hackerone.com threatpost.com
Oct 16, 2024The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to mCVE-2016-15042 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wpscan.com
Oct 16, 2024Accordion Slider: Stored Cross-Site ScriptingCVE-2024-9582 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in all versions up to, and including, 1.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Successful exploitation by Contributor-level users requires an Administrator-level user to provide access to the plugin's admin area via the `Access` plugin setting, which is restricted to administrators by default.
Product
Accordion Slider
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update Accordion Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024File Manager Pro: Limited JavaScript File UploadCVE-2024-8918 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024File Manager Pro: Arbitrary backup file downloads and uploadsCVE-2024-8746 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024File Manager Pro: Cross-Site Request ForgeryCVE-2024-8507 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized data modificationCVE-2023-7294 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the create_mollie_profile function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to create a mollie payment profile.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized access of dataCVE-2023-7293 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_mollie_account_details function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to verify the existence of a mollie account.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized notification dismissalCVE-2023-7292 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized notification dismissal due to a missing capability check on the paytium_notice_dismiss function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to dismiss admin notices.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized modification of dataCVE-2023-7291 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_mollie_account function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to set up a mollie account.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized access of dataCVE-2023-7290 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_for_verified_profiles function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to check profile statuses.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized API key updateCVE-2023-7289 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytium_sw_save_api_keys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin API keys.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized data modificationCVE-2023-7288 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_profile_preference function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin settings.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized subscription cancellationCVE-2023-7287 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on the pt_cancel_subscription function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to cancel a subscription to the plugin.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024plugin ACF Quick Edit Fields: Insecure Direct Object ReferenceCVE-2023-7286 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin ACF Quick Edit Fields for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.2.2. This makes it possible for attackers without the edit_users capability to access metadata of other users, this includes contributor-level users and above.
Product
plugin ACF Quick Edit Fields
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update plugin ACF Quick Edit Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 16, 2024The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to mCVE-2022-4974 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record freemius.com web.archive.org
Oct 16, 2024WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress CVE-2022-4973 · WordPress plugins & themes · reported by WordfenceMedium 4.9
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org wordpress.org
Oct 16, 2024Download Monitor: Authorization bypassCVE-2022-4972 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
Product
Download Monitor
Affected
up to 4.7.51
What to do
Affects up to 4.7.51. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Sassy Social Share: Reflected Cross-Site ScriptingCVE-2022-4971 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Sassy Social Share
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
Oct 16, 2024NinjaFirewall: Authenticated PHAR DeserializationCVE-2021-4451 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall).
Product
NinjaFirewall
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update NinjaFirewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Oct 16, 2024Post Grid: Blind SQL InjectionCVE-2021-4450 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Post Grid
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024ZoomSounds: Arbitrary file uploadsCVE-2021-4449 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepng.php' file in versions up to, and including, 5.96. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2021-4457 is a duplicate of this.
Product
ZoomSounds
Affected
up to 5.96
What to do
Affects up to 5.96. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net github.com
Oct 16, 2024Kaswara Modern VC Addons: Authorization bypassCVE-2021-4448 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.
Product
Kaswara Modern VC Addons
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Kaswara Modern VC Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 16, 2024Essential Addons for Elementor: Privilege escalationCVE-2021-4447 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user.
Product
Essential Addons for Elementor
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Essential Addons for Elementor: Authorization bypassCVE-2021-4446 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins.
Product
Essential Addons for Elementor
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Premium Addons for Elementor: Arbitrary Option UpdatesCVE-2021-4445 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.
Product
Premium Addons for Elementor
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ithemes.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.