Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,498 results · page 519 of 830
Oct 12, 2024Social Sharing (by Danny): Stored Cross-Site ScriptingCVE-2024-9704 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortcode in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Social Sharing (by Danny)
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Social Sharing (by Danny) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 12, 2024WordPress File Upload: Path TraversalCVE-2024-9047 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
- Product
- WordPress File Upload
- Affected
- up to 4.24.11
- What to do
- Affects up to 4.24.11. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 12, 2024ImagePress – Image Gallery: Unauthorized modification and loss of dataCVE-2024-9824 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ip_delete_post' and 'ip_update_post_title' functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts and update post titles.
- Product
- ImagePress – Image Gallery
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 12, 2024ImagePress – Image Gallery: Cross-Site Request ForgeryCVE-2024-9778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImagePress – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the 'imagepress_admin_page' function. This makes it possible for unauthenticated attackers to update plugin settings, including redirection URLs, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ImagePress – Image Gallery
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 12, 2024ImagePress – Image Gallery: Stored Cross-Site ScriptingCVE-2024-9776 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ImagePress – Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- ImagePress – Image Gallery
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 12, 20242D Tag Cloud: Reflected Cross-Site ScriptingCVE-2024-9670 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 2D Tag Cloud plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 6.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- 2D Tag Cloud
- Affected
- up to 6.0.2
- What to do
- Affects up to 6.0.2. Update 2D Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 12, 2024Mynx Page Builder: Stored Cross-Site ScriptingCVE-2024-9656 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mynx Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Mynx Page Builder
- Affected
- up to 0.27.8
- What to do
- Affects up to 0.27.8. Update Mynx Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 12, 2024Read more By Adam: Unauthorized loss of dataCVE-2024-9187 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Read more By Adam plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteRm() function in all versions up to, and including, 1.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete read more buttons.
- Product
- Read more By Adam
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Read more By Adam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 12, 2024Forms for Mailchimp by Optin Cat – Grow Your MailChimp List: Stored Cross-Site ScriptingCVE-2024-7489 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form color parameters in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Forms for Mailchimp by Optin Cat – Grow Your MailChimp List
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update Forms for Mailchimp by Optin Cat – Grow Your MailChimp List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024Bridge Core: Unauthorized modification of data or loss of dataCVE-2024-9860 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'import_action' and 'install_plugin_per_demo' functions in versions up to, and including, 3.3. This makes it possible for authenticated attackers with subscriber-level permissions or above, to delete or change plugin settings, import demo data, and install limited plugins.
- Product
- Bridge Core
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Bridge Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 11, 2024Bot for Telegram on WooCommerce: Sensitive information disclosureCVE-2024-9821 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcfto_get_settings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the Telegram Bot Token, a secret token used to control the bot, which can then be used to log in as any existing user on the site, such as an administrator, if they know the username, due to the Login with Telegram feature.
- Product
- Bot for Telegram on WooCommerce
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Bot for Telegram on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 11, 2024Easy PayPal Gift Certificate: Cross-Site Request ForgeryCVE-2024-9592 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy PayPal Gift Certificate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the 'wpppgc_plugin_options' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Easy PayPal Gift Certificate
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Easy PayPal Gift Certificate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 11, 2024CM Tooltip Glossary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48041 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary enhanced-tooltipglossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through <= 4.3.9.
- Product
- CM Tooltip Glossary
- Affected
- up to 4.3.9
- What to do
- Affects up to 4.3.9. Update CM Tooltip Glossary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024Tainacan: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-48040 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows SQL Injection.This issue affects Tainacan: from n/a through <= 0.21.8.
- Product
- Tainacan
- Affected
- up to 0.21.8
- What to do
- Affects up to 0.21.8. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024Talkback: Deserialization of Untrusted DataCVE-2024-48033 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in baptiste.gourdin Talkback talkback-secure-linkback-protocol allows Object Injection.This issue affects Talkback: from n/a through <= 1.0.
- Product
- Talkback
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Talkback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024Backup and Staging by WP Time Capsule: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-48020 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
- Product
- Backup and Staging by WP Time Capsule
- Affected
- up to 1.22.21
- What to do
- Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024ElementsReady Addons for Elementor: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47353 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite.This issue affects ElementsReady Addons for Elementor: from n/a through 6.4.2.
- Product
- ElementsReady Addons for Elementor
- Affected
- up to 6.4.2
- What to do
- Affects up to 6.4.2. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024Multi Step for Contact Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47331 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through <= 2.7.7.
- Product
- Multi Step for Contact Form
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update Multi Step for Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024Hunk Companion: Unauthorized plugin installation/activationCVE-2024-9707 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
- Product
- Hunk Companion
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Hunk Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 11, 2024BlockMeister – Block Pattern Builder: Reflected Cross-Site ScriptingCVE-2024-9616 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BlockMeister – Block Pattern Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- BlockMeister – Block Pattern Builder
- Affected
- up to 3.1.10
- What to do
- Affects up to 3.1.10. Update BlockMeister – Block Pattern Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024Increase upload file size & Maximum Execution Time limit: Reflected Cross-Site ScriptingCVE-2024-9611 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Increase upload file size & Maximum Execution Time limit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Increase upload file size & Maximum Execution Time limit
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Increase upload file size & Maximum Execution Time limit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024Language Switcher: Reflected Cross-Site ScriptingCVE-2024-9610 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.7.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Language Switcher
- Affected
- up to 3.7.13
- What to do
- Affects up to 3.7.13. Update Language Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024Linkz.ai: Unauthorized modification of dataCVE-2024-9587 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' function in versions up to, and including, 1.1.8. This makes it possible for authenticated attackers with contributor-level privileges or above, to update plugin settings.
- Product
- Linkz.ai
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Linkz.ai to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024Linkz.ai: Unauthorized modification of dataCVE-2024-9586 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' and 'check_logout' functions in versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update plugin settings.
- Product
- Linkz.ai
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Linkz.ai to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024PowerPress Podcasting plugin by Blubrry: Stored Cross-Site ScriptingCVE-2024-9543 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skipto' shortcode in all versions up to, and including, 11.9.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- PowerPress Podcasting plugin by Blubrry
- Affected
- up to 11.9.18
- What to do
- Affects up to 11.9.18. Update PowerPress Podcasting plugin by Blubrry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblubrry.complugins.trac.wordpress.org
Oct 11, 2024ShopLentor: Sensitive Information ExposureCVE-2024-9538 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ShopLentor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.8 via the 'render' function in includes/addons/wl_faq.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
- Product
- ShopLentor
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update ShopLentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 11, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Arbitrary file readCVE-2024-9507 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.15.2 due to improper input validation within the iconUpload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to leverage a PHP filter chain attack and read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
- Affected
- up to 2.15.2
- What to do
- Affects up to 2.15.2. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Reflected Cross-Site ScriptingCVE-2024-9436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Affected
- up to 3.5.14
- What to do
- Affects up to 3.5.14. Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024Embed videos and respect privacy: Reflected Cross-Site ScriptingCVE-2024-9346 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Embed videos and respect privacy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'v' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Embed videos and respect privacy
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Embed videos and respect privacy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor: Arbitrary file uploadsCVE-2024-9234 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.
- Product
- GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 11, 2024Download Plugins and Themes in ZIP from Dashboard: Reflected Cross-Site ScriptingCVE-2024-9232 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Download Plugins and Themes in ZIP from Dashboard
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024Tainacan: Reflected Cross-Site ScriptingCVE-2024-9221 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.21.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Tainacan
- Affected
- up to 0.21.10
- What to do
- Affects up to 0.21.10. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024FULL – Cliente: Reflected Cross-Site ScriptingCVE-2024-9211 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FULL – Cliente plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.22. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- FULL – Cliente
- Affected
- up to 3.1.22
- What to do
- Affects up to 3.1.22. Update FULL – Cliente to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024WP Ultimate Post Grid: Stored Cross-Site ScriptingCVE-2024-9051 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpupg-grid-with-filters shortcode in all versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Ultimate Post Grid
- Affected
- up to 3.9.3
- What to do
- Affects up to 3.9.3. Update WP Ultimate Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2024The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Sensitive Information ExposureCVE-2024-8913 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.11 via the render function in modules/widgets/tp_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
- Product
- The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
- Affected
- up to 5.6.11
- What to do
- Affects up to 5.6.11. Update The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 11, 2024WordPress Comments Import & Export: To arbitrary file readCVE-2024-7514 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The issue was partially fixed in version 2.3.8 and fully fixed in 2.3.9
- Product
- WordPress Comments Import & Export
- Affected
- up to 2.3.7
- Fixed in
- 2.3.8
- What to do
- Update WordPress Comments Import & Export to 2.3.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 10, 2024Pedalo Connector: Authentication bypassCVE-2024-9822 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the administrator, or if it does not exist, then to the first administrator.
- Product
- Pedalo Connector
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Pedalo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 10, 2024EventPrime: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47648 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Metagauss EventPrime eventprime-event-calendar-management.This issue affects EventPrime: from n/a through <= 4.0.4.5.
- Product
- EventPrime
- Affected
- up to 4.0.4.5
- What to do
- Affects up to 4.0.4.5. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2024Simple Membership After Login Redirection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47354 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirection.This issue affects Simple Membership After Login Redirection: from n/a through <= 1.6.
- Product
- Simple Membership After Login Redirection
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Simple Membership After Login Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2024JobSearch: Deserialization of Untrusted DataCVE-2024-47636 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5.9.
- Product
- JobSearch
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2024WP-Advanced-Search: Does not sanitize and escape the t parameter before using it in a SQL statementCVE-2024-9796 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- WP-Advanced-Search
- Fixed in
- 3.3.9.2
- What to do
- Update WP-Advanced-Search to 3.3.9.2 or newer.
Oct 10, 2024TI WooCommerce Wishlist: Is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL queryCVE-2024-9156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- TI WooCommerce Wishlist
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2024UserPlus: Unauthorized access, modification, and loss of dataCVE-2024-9520 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, to add, modify, or delete user meta and plugin options.
- Product
- UserPlus
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update UserPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2024Advanced Blocks Pro: Stored Cross-Site ScriptingCVE-2024-9074 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Advanced Blocks Pro
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Advanced Blocks Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 9, 2024Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized modification of dataCVE-2024-9067 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'delete_attachment' function in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments.
- Product
- Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2024TS Poll – Survey, Versus Poll, Image Poll, Video Poll: SQL InjectionCVE-2024-9022 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- TS Poll – Survey, Versus Poll, Image Poll, Video Poll
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update TS Poll – Survey, Versus Poll, Image Poll, Video Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Oct 9, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue): Cross-Site Request ForgeryCVE-2024-8477 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.87. This is due to missing or incorrect nonce validation on the Init() function. This makes it possible for unauthenticated attackers to log out of a Brevo connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue)
- Affected
- up to 3.1.87
- What to do
- Affects up to 3.1.87. Update Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 9, 2024Notification for Telegram: Unauthorized test message sendingCVE-2024-9685 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftb_test_action' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send a test message via the Telegram Bot API to all users configured in the settings.
- Product
- Notification for Telegram
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2024Shortcodes AnyWhere: Arbitrary shortcode executionCVE-2024-9581 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- Shortcodes AnyWhere
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Shortcodes AnyWhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 9, 2024WP Users Masquerade: Authentication bypassCVE-2024-9522 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajax_masq_login' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.
- Product
- WP Users Masquerade
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update WP Users Masquerade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.