Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

567new WordPress flaws this week

391,397entries in the database

3,865 results · page 52 of 78

Nov 16, 2024Customer Reviews for WooCommerce: Unauthorized accessCVE-2024-10614 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() function in all versions up to, and including, 5.61.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel and import or check on the status.
Product
Customer Reviews for WooCommerce
Affected
up to 5.61.0
What to do
Affects up to 5.61.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 16, 2024Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX: Unauthorized plugin installation/activationCVE-2024-10728 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function in all versions up to, and including, 4.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
Product
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX
Affected
up to 4.1.16
What to do
Affects up to 4.1.16. Update Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024WP Log Viewer: Unauthorized use of functionalityCVE-2024-11085 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Log Viewer plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on several AJAX actions in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access logs, update plugin-related user settings and general plugin settings.
Product
WP Log Viewer
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update WP Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024WP Chat App: Unauthorized plugin installationCVE-2024-10533 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function in all versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the filebird plugin.
Product
WP Chat App
Affected
up to 3.6.8
What to do
Affects up to 3.6.8. Update WP Chat App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024Popup Box – Create Countdown, Coupon, Video, Contact Form Popups: Unauthorized modification of dataCVE-2024-10861 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data.
Product
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update Popup Box – Create Countdown, Coupon, Video, Contact Form Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024Simple Local Avatars: Unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache functionCVE-2024-10786 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear user caches.
Product
Simple Local Avatars
Affected
up to 2.7.11
What to do
Affects up to 2.7.11. Update Simple Local Avatars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024Music Player for Elementor – Audio Player & Podcast Player: Unauthorized modification of dataCVE-2024-10582 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_mpfe_template() function in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import templates.
Product
Music Player for Elementor – Audio Player & Podcast Player
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Music Player for Elementor – Audio Player & Podcast Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 15, 2024Tutor LMS Elementor Addons: Unauthorized plugin installationCVE-2024-10897 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install Elementor or Tutor LMS. Please note the impact of this issue is incredibly limited due to the fact that these two plugins will likely already be installed as a dependency of the plugin.
Product
Tutor LMS Elementor Addons
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Tutor LMS Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024LUNA RADIO PLAYER: Directory TraversalCVE-2024-10816 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.24.01.24 via the js/fallback.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
LUNA RADIO PLAYER
Affected
up to 6.24.01.24
What to do
Affects up to 6.24.01.24. Update LUNA RADIO PLAYER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record radioplayer.luna-universe.com wordfence.com
Nov 12, 2024Hash Elements: Unauthorized access of dataCVE-2024-10802 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to retrieve draft post titles that should not be accessible to unauthenticated users.
Product
Hash Elements
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Hash Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2024Kognetiks Chatbot for: Unauthorized modification of dataCVE-2024-10531 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to update GTP assistants.
Product
Kognetiks Chatbot for
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Kognetiks Chatbot for: Unauthorized modification of dataCVE-2024-10530 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the add_new_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to create new GTP assistants.
Product
Kognetiks Chatbot for
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Kognetiks Chatbot for: Unauthorized modification of dataCVE-2024-10529 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete GTP assistants.
Product
Kognetiks Chatbot for
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Hide Links: Unauthorized shortcode executionCVE-2024-9578 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to do_shortcode being hooked through the comment_text filter in all versions up to and including 1.4.2. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.
Product
Hide Links
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Hide Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2024Buy one click WooCommerce: Unauthorized modification of dataCVE-2024-10854 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buy_one_click_import_options AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import plugin settings.
Product
Buy one click WooCommerce
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update Buy one click WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 12, 2024Buy one click WooCommerce: Unauthorized modification of dataCVE-2024-10853 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete Buy one click WooCommerce orders.
Product
Buy one click WooCommerce
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update Buy one click WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 12, 2024Buy one click WooCommerce: Unauthorized access of dataCVE-2024-10852 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the buy_one_click_export_options AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export plugin settings.
Product
Buy one click WooCommerce
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update Buy one click WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 12, 2024Styler for Ninja Forms: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-10717 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the deactivate_license function in all versions up to, and including, 3.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users. Note: This issue can also be used to add arbitrary options with an empty value.
Product
Styler for Ninja Forms
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update Styler for Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Leopard - WordPress Offload Media: Unauthorized modification of data that can lead to privilege escalationCVE-2024-10589 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the import_settings() function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Leopard - WordPress Offload Media
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Leopard - WordPress Offload Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 8, 2024Th Shop Mania: Unauthorized arbitrary plugin installationCVE-2024-10674 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_install_and_activate_callback() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins which can be leveraged to exploit other vulnerabilities and achieve remote code execution and privilege escalation.
Product
Th Shop Mania
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Th Shop Mania to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.svn.wordpress.org themes.trac.wordpress.org
Nov 8, 2024Top Store: Unauthorized arbitrary plugin installationCVE-2024-10673 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_activate_callback() function in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins which can contain other exploitable vulnerabilities to elevate privileges and gain remote code execution.
Product
Top Store
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Top Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Nov 8, 2024Debug Tool: Unauthorized access of dataCVE-2024-10588 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Debug Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the info() function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to obtain information from phpinfo(). When WP_DEBUG is enabled, this can be exploited by unauthenticated users as well.
Product
Debug Tool
Affected
up to 2.2
What to do
Affects up to 2.2. Update Debug Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 8, 2024CE21 Suite: Unauthorized modification of dataCVE-2024-10294 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single_sign_on_save_api_settings' function in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to change plugin settings.
Product
CE21 Suite
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update CE21 Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 6, 2024EleForms – All In One Form Integration including DB for Elementor: Unauthorized access of dataCVE-2024-6626 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and including, 2.9.9.9. This makes it possible for unauthenticated attackers to view form submissions.
Product
EleForms – All In One Form Integration including DB for Elementor
Affected
up to 2.9.9.9
What to do
Affects up to 2.9.9.9. Update EleForms – All In One Form Integration including DB for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2024Tumult Hype Animations: Unauthorized access of dataCVE-2024-10543 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimations_getcontent function in all versions up to, and including, 1.9.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve animation information.
Product
Tumult Hype Animations
Affected
up to 1.9.14
What to do
Affects up to 1.9.14. Update Tumult Hype Animations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 6, 2024Video Gallery for WooCommerce: Unauthorized modification of dataCVE-2024-10535 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unused_thumbnails() function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails in the video-wc-gallery-thumb directory.
Product
Video Gallery for WooCommerce
Affected
up to 1.31
What to do
Affects up to 1.31. Update Video Gallery for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2024Zotpress: Unauthorized modification of dataCVE-2024-7429 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin's settings.
Product
Zotpress
Affected
up to 7.3.12
What to do
Affects up to 7.3.12. Update Zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2024Stacks Mobile App Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-50528 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Retrieve Embedded Sensitive Data.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Product
Stacks Mobile App Builder
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Multiple Page Generator Plugin – MPG: Unauthorized modification of and access to dataCVE-2024-7424 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those functions intended for admin use resulting in subscribers being able to upload csv files and view the contents of MPG projects.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2024Get Quote For Woocommerce – Request A Quote For Woocommerce: Unauthorized access of Quote dataCVE-2024-9430 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capability check on the ct_tepfw_wp_loaded function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to download Quote PDF and CSV documents.
Product
Get Quote For Woocommerce – Request A Quote For Woocommerce
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Get Quote For Woocommerce – Request A Quote For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 30, 2024Download Monitor: Unauthorized modification of dataCVE-2024-10399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain usernames and emails of site users.
Product
Download Monitor
Affected
up to 5.0.13
What to do
Affects up to 5.0.13. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2024WP Booking System: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-50425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Murg WP Booking System wp-booking-system.This issue affects WP Booking System: from n/a through <= 2.0.19.10.
Product
WP Booking System
Affected
up to 2.0.19.10
What to do
Affects up to 2.0.19.10. Update WP Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024WPC Smart Messages for WooCommerce: Unauthorized Smar Message activation/deactivationCVE-2024-10437 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajax_enable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate smart messages.
Product
WPC Smart Messages for WooCommerce
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update WPC Smart Messages for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2024Masteriyo LMS – eLearning and Online Course Builder for: Unauthorized user profile modificationCVE-2024-10008 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.
Product
Masteriyo LMS – eLearning and Online Course Builder for
Affected
up to 1.13.3
What to do
Affects up to 1.13.3. Update Masteriyo LMS – eLearning and Online Course Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 28, 2024Contact Form 7 + Telegram: Unauthorized modification of data and loss of dataCVE-2024-9629 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wpcf7_Telegram::ajax' function in versions up to, and including, 0.8.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve, pause and refuse subscriptions.
Product
Contact Form 7 + Telegram
Affected
up to 0.8.5
What to do
Affects up to 0.8.5. Update Contact Form 7 + Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 26, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Unauthorized accessCVE-2024-10402 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to create new or edit existing forms, including updating the default registration role to Administrator on User Registration forms.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.35.1
What to do
Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 26, 2024Download Monitor: Unauthorized modification of dataCVE-2024-10092 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actions function in all versions up to, and including, 5.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to revoke existing API keys and generate new ones.
Product
Download Monitor
Affected
up to 5.0.12
What to do
Affects up to 5.0.12. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2024Editorial Assistant by Sovrn: Unauthorized modification of dataCVE-2024-9626 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Editorial Assistant by Sovrn plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_zemanta_set_featured_image' function in versions up to, and including, 1.3.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload attachment files (such as jpg, png, txt, zip), and set the post featured image.
Product
Editorial Assistant by Sovrn
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Editorial Assistant by Sovrn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2024Image Map Pro: Unauthorized modification of data and loss of dataCVE-2024-9584 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functions in versions up to, and including, 6.0.20. This makes it possible for authenticated attackers with contributor-level privileges or above, to add, update or delete map projects.
Product
Image Map Pro
Affected
up to 6.0.20
What to do
Affects up to 6.0.20. Update Image Map Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record imagemappro.com wordfence.com
Oct 25, 2024WPS Telegram Chat: Unauthorized modification of data and loss of dataCVE-2024-9628 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Telegram_Chat_Admin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the Telegram Bot API endpoint and communicate with it.
Product
WPS Telegram Chat
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update WPS Telegram Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2024Mapster WP Maps: Unauthorized modification of data that can lead to privilege escalationCVE-2024-9235 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an insufficient capability check on the mapster_wp_maps_set_option_from_js() function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with contributor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Mapster WP Maps
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 25, 2024WooCommerce UPS Shipping – Live Rates and Access Points: Unauthorized modification of dataCVE-2024-9109 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_oauth_data function in all versions up to, and including, 2.3.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's API key.
Product
WooCommerce UPS Shipping – Live Rates and Access Points
Affected
up to 2.3.12
What to do
Affects up to 2.3.12. Update WooCommerce UPS Shipping – Live Rates and Access Points to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2024Order Notification for Telegram: Unauthorized test message sendingCVE-2024-9686 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nktgnfw_send_test_message' function in versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to send a test message via the Telegram Bot API to the user configured in the settings.
Product
Order Notification for Telegram
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Order Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2024MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution: Unauthorized modification of dataCVE-2024-9531 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvx_sent_deactivation_request' function in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send a canned email to the site's administrator asking to delete the profile of an arbitrary vendor.
Product
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution
Affected
up to 4.2.4
What to do
Affects up to 4.2.4. Update MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2024HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce: Unauthorized post publicationCVE-2024-8667 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to a missing capability check on the activateCampaign() function in all versions up to, and including, 2.10.0. This makes it possible for authenticated attackers, with contributor-level access and above, to publish arbitrary posts like ones they have submitted for review, or a site administrator has in draft.
Product
HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 23, 2024RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging: Unauthorized use of functionalityCVE-2024-9583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the wprss_ajax_send_premium_support function in all versions up to, and including, 4.23.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send premium support requests with an attacker-controlled subject line and email address to support allowing them to impersonate the site owner. License information may also be leaked.
Product
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
Affected
up to 4.23.12
What to do
Affects up to 4.23.12. Update RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 23, 2024Download: Unauthorized access of dataCVE-2024-9829 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handle_download_user' and 'dpwap_handle_download_comment' functions in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download any comment, and download metadata for any user including user PII and sensitive information including username, email, hashed passwords and application passwords, session token information and more depending on set up and additional plugins installed.
Product
Download
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2024Rover IDX: Unauthorized access, modification, and loss of dataCVE-2024-10003 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 3.0.0.2903. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options.
Product
Rover IDX
Affected
up to 3.0.0.2903
What to do
Affects up to 3.0.0.2903. Update Rover IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2024WP Easy Post Types: Unauthorized access, modification, and loss of dataCVE-2024-10078 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.
Product
WP Easy Post Types
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update WP Easy Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2024SendGrid for: Unauthorized loss of dataCVE-2024-9364 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' function in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's log files.
Product
SendGrid for
Affected
up to 1.4
What to do
Affects up to 1.4. Update SendGrid for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.