Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

555new WordPress flaws this week

398,769entries in the database

41,498 results · page 530 of 830

Sep 11, 2024video carousel slider with lightbox: SQL InjectionCVE-2019-25212 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
video carousel slider with lightbox
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update video carousel slider with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 11, 2024Advanced WordPress Backgrounds: Stored Cross-Site ScriptingCVE-2024-8045 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced WordPress Backgrounds
Affected
up to 1.12.3
What to do
Affects up to 1.12.3. Update Advanced WordPress Backgrounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file movement and readingCVE-2024-7626 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
Product
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-8440 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024Logo Slider: Does not sanitise and escape some of its settingsCVE-2024-7716 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Logo Slider
Fixed in
3.6.9
What to do
Update Logo Slider to 3.6.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2024Gallery Plugin for WordPress: Does not sanitise and escape some of its image settingsCVE-2024-3899 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks.
Product
Gallery Plugin for WordPress
Fixed in
1.8.15
What to do
Update Gallery Plugin for WordPress to 1.8.15 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2024HTML5 Video Player – mp4 Video Player Plugin and Block: Unauthorized access of dataCVE-2024-7727 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data.
Product
HTML5 Video Player – mp4 Video Player Plugin and Block
Affected
up to 2.5.32
What to do
Affects up to 2.5.32. Update HTML5 Video Player – mp4 Video Player Plugin and Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024HTML5 Video Player – mp4 Video Player Plugin and Block: Unauthorized modification of dataCVE-2024-7721 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to, and including, 2.5.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set any options that are not explicitly checked as false to an array, including enabling user registration if it has been disabled.
Product
HTML5 Video Player – mp4 Video Player Plugin and Block
Affected
up to 2.5.34
What to do
Affects up to 2.5.34. Update HTML5 Video Player – mp4 Video Player Plugin and Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024Post Grid and Gutenberg Blocks: Privilege escalationCVE-2024-8253 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not properly restricting what user meta values can be updated and ensuring a form is active. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta to become an administrator.
Product
Post Grid and Gutenberg Blocks
What to do
Update Post Grid and Gutenberg Blocks to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024EventPrime – Events Calendar, Bookings and Tickets: Unauthorized access to Private or Password-protected eventsCVE-2024-8369 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view private or password-protected events.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 4.0.4.3
What to do
Affects up to 4.0.4.3. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 10, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-6282 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-jltma-wrapper-link element in all versions up to, and including 2.0.6.4 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
Product
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Affected
up to 2.0.6.4
What to do
Affects up to 2.0.6.4. Update Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024Bit File Manager – 100% Free & Open Source File Manager and Code Editor for: Arbitrary file uploadsCVE-2024-7770 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 6.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted upload permissions by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for
Affected
up to 6.5.5
What to do
Affects up to 6.5.5. Update Bit File Manager – 100% Free & Open Source File Manager and Code Editor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024Slider comparison image before and after: Stored Cross-Site ScriptingCVE-2024-8543 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider comparison image before and after plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [sciba] shortcode in all versions up to, and including, 0.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider comparison image before and after
Affected
up to 0.8.3
What to do
Affects up to 0.8.3. Update Slider comparison image before and after to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2024Nova Blocks by Pixelgrade: Stored Cross-Site ScriptingCVE-2024-8241 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Nova Blocks by Pixelgrade
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Nova Blocks by Pixelgrade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 10, 2024Tutor LMS: Cross-Site Request ForgeryCVE-2023-2919 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addon_enable_disable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Tutor LMS
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles: Stored Cross-Site ScriptingCVE-2024-7655 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles
Affected
up to 6.4.5.0
What to do
Affects up to 6.4.5.0. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles: Stored Cross-Site ScriptingCVE-2024-7618 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles
Affected
up to 6.4.5.0
What to do
Affects up to 6.4.5.0. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2024Starbox: Does not sanitise and escape some of its settingsCVE-2024-7955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Starbox
Fixed in
3.5.2
What to do
Update Starbox to 3.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 10, 2024Floating Contact Button: Does not sanitise and escape some of its settingsCVE-2024-7891 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Floating Contact Button
Fixed in
2.8
What to do
Update Floating Contact Button to 2.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2024The Affiliate Super Assistent: Arbitrary shortcode executionCVE-2024-8478 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Affiliate Super Assistent
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update The Affiliate Super Assistent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2024Frontend Dashboard: Unauthorized code executionCVE-2024-8268 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords.
Product
Frontend Dashboard
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2024Pocket Widget: Does not sanitise and escape some of its settingsCVE-2024-7918 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pocket Widget WordPress plugin through 0.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Pocket Widget
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Pocket Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 9, 2024Snapshot Backup: Does not have CSRF check in some placesCVE-2024-7689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Snapshot Backup
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Snapshot Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 9, 2024AZIndex: Does not have CSRF checks in some placesCVE-2024-7688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary indexes via a CSRF attack
Product
AZIndex
Affected
up to 0.8.1
What to do
Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 9, 2024AZIndex: Does not have CSRF check in some placesCVE-2024-7687 · WordPress plugins & themes · reported by WPScanMedium 4.3
The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
AZIndex
Affected
up to 0.8.1
What to do
Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 9, 2024EventON: Does not sanitise and escape some of its settingsCVE-2024-6910 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
EventON
Fixed in
2.2.17
What to do
Update EventON to 2.2.17 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2024Popup Maker: Does not sanitise and escape some of its settingsCVE-2024-5561 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Popup Maker
Fixed in
1.19.1
What to do
Update Popup Maker to 1.19.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2024Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1.CVE-2024-45625 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.
Fixed in
1.34.1
What to do
Update the plugin to 1.34.1 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Sep 8, 2024Opti Marketing: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6928 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
Opti Marketing
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Opti Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 8, 2024TrueBooker: Does not have CSRF check in placeCVE-2024-6925 · WordPress plugins & themes · reported by WPScanMedium 4.3
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
TrueBooker
Fixed in
1.0.3
What to do
Update TrueBooker to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 8, 2024TrueBooker: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6924 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
TrueBooker
Fixed in
1.0.3
What to do
Update TrueBooker to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 8, 2024WP MultiTasking: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6859 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP MultiTasking
Affected
up to 0.1.12
What to do
Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6856 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP MultiTasking
Affected
up to 0.1.12
What to do
Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 8, 2024WP MultiTasking: Does not have CSRF checkCVE-2024-6855 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
Product
WP MultiTasking
Affected
up to 0.1.12
What to do
Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 8, 2024WP MultiTasking: Does not have CSRF checkCVE-2024-6853 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
Product
WP MultiTasking
Affected
up to 0.1.12
What to do
Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6852 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP MultiTasking
Affected
up to 0.1.12
What to do
Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 7, 2024Customizer Export/Import: Arbitrary file uploadsCVE-2024-7620 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.
Product
Customizer Export/Import
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Customizer Export/Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 7, 2024Pinpoint Booking System – #1 WordPress Booking: SQL InjectionCVE-2024-7112 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up to, and including, 2.9.9.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Pinpoint Booking System – #1 WordPress Booking
Affected
up to 2.9.9.5.0
What to do
Affects up to 2.9.9.5.0. Update Pinpoint Booking System – #1 WordPress Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 7, 2024Cost Calculator Builder PRO: Price manipulationCVE-2024-6010 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.
Product
Cost Calculator Builder PRO
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Cost Calculator Builder PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com plugins.trac.wordpress.org
Sep 7, 2024Ninja Forms - File Uploads: Stored Cross-Site ScriptingCVE-2024-1596 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms - File Uploads
Affected
up to 3.3.16
What to do
Affects up to 3.3.16. Update Ninja Forms - File Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ninjaforms.com ninjaforms.com
Sep 7, 2024Big File Uploads – Increase Maximum File Upload Size: Full Path DisclosureCVE-2024-8538 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This makes it possible for authenticated attackers, with author-level access and above, to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Big File Uploads – Increase Maximum File Upload Size
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Big File Uploads – Increase Maximum File Upload Size to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 7, 2024Preloader Plus – WordPress Loading Screen: Stored Cross-Site ScriptingCVE-2024-6849 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Preloader Plus – WordPress Loading Screen
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Preloader Plus – WordPress Loading Screen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 6, 2024ForumWP – Forum & Discussion Board: Privilege EscalationCVE-2024-8428 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submit_form_handler due to missing validation on the 'user_id' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address of administrative user accounts which can then be leveraged to reset the administrative users password and gain access to their account.
Product
ForumWP – Forum & Discussion Board
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update ForumWP – Forum & Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024Revision Manager TMC: Unauthorized arbitrary email sendingCVE-2024-7622 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the _a_ajaxQuickEmailTestCallback() function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to send emails with arbitrary content to any individual through the vulnerable web server.
Product
Revision Manager TMC
Affected
up to 2.8.19
What to do
Affects up to 2.8.19. Update Revision Manager TMC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024Enter Addons – Ultimate Template Builder for Elementor: Stored Cross-Site ScriptingCVE-2024-7611 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Enter Addons – Ultimate Template Builder for Elementor
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Enter Addons – Ultimate Template Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024Advanced Sermons: Stored Cross-Site ScriptingCVE-2024-7599 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermon_video_embed’ parameter in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Sermons
Affected
up to 3.3
What to do
Affects up to 3.3. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024WPCOM Member: Privilege escalationCVE-2024-7493 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wp_insert_user() during registration. This makes it possible for unauthenticated attackers to update their role to that of an administrator during registration.
Product
WPCOM Member
Affected
up to 1.5.2.1
What to do
Affects up to 1.5.2.1. Update WPCOM Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024Frontend Post Submission Manager Lite – Frontend Posting: Unauthorized modification of dataCVE-2024-8427 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_global_settings and process_form_edit functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and forms.
Product
Frontend Post Submission Manager Lite – Frontend Posting
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Frontend Post Submission Manager Lite – Frontend Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024WP AdCenter – Ad Manager & Adsense Ads: Stored Cross-Site ScriptingCVE-2024-8317 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ad_alignment’ attribute in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP AdCenter – Ad Manager & Adsense Ads
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update WP AdCenter – Ad Manager & Adsense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024WP-Recall – Registration, Profile, Commerce & More: Privilege escalation/account takeoverCVE-2024-8292 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for unauthenticated attackers to supply any email through the user_email field and update the password for that user during new order creation. This requires the commerce addon to be enabled in order to exploit.
Product
WP-Recall – Registration, Profile, Commerce & More
Affected
up to 16.26.8
What to do
Affects up to 16.26.8. Update WP-Recall – Registration, Profile, Commerce & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.