Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,498 results · page 542 of 830
Jul 31, 2024WP Mobile Menu: Unauthorized modification of dataCVE-2024-2508 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the '_mobmenu_icon' post meta to arbitrary posts with an arbitrary (but sanitized) value. NOTE: Version 2.8.4.4 contains a partial fix for this vulnerability.
- Product
- WP Mobile Menu
- Affected
- up to 2.8.4.4
- What to do
- Affects up to 2.8.4.4. Update WP Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 31, 2024Lifetime free Drag & Drop Contact Form Builder for WordPress VForm: Stored Cross-Site ScriptingCVE-2024-6770 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Lifetime free Drag & Drop Contact Form Builder for WordPress VForm
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Lifetime free Drag & Drop Contact Form Builder for WordPress VForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2024it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions.CVE-2024-6695 · WordPress plugins & themes · reported by WPScanCritical 9.8
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
- Fixed in
- 3.11.9
- What to do
- Update the plugin to 3.11.9 or newer.
Jul 31, 2024HTML Forms: Does not have CSRF checks in some placesCVE-2024-6412 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- HTML Forms
- Fixed in
- 1.3.34
- What to do
- Update HTML Forms to 1.3.34 or newer.
Jul 31, 2024Slider by 10Web: Does not sanitise and escape its Slider TitleCVE-2024-6408 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Slider by 10Web
- Fixed in
- 1.2.57
- What to do
- Update Slider by 10Web to 1.2.57 or newer.
Jul 31, 2024SpiderContacts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- SpiderContacts
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update SpiderContacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 31, 2024WANotifier: Does not sanitise and escape some of its settingsCVE-2024-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WANotifier
- Fixed in
- 2.6.1
- What to do
- Update WANotifier to 2.6.1 or newer.
Jul 30, 2024SiteOrigin Widgets Bundle: Stored Cross-Site ScriptingCVE-2024-5901 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including, 1.62.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SiteOrigin Widgets Bundle
- Affected
- up to 1.62.2
- What to do
- Affects up to 1.62.2. Update SiteOrigin Widgets Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 30, 2024Bold Page Builder: Stored Cross-Site ScriptingCVE-2024-7100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_button shortcode in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Bold Page Builder
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 30, 2024Zephyr Project Manager: Does not sanitise and escape some of its settingsCVE-2024-6536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Zephyr Project Manager
- Fixed in
- 3.3.99
- What to do
- Update Zephyr Project Manager to 3.3.99 or newer.
Jul 30, 2024پلاگین پرداخت دلخواه: Does not have CSRF check in placeCVE-2024-6230 · WordPress plugins & themes · reported by WPScanMedium 6.5
The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- پلاگین پرداخت دلخواه
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update پلاگین پرداخت دلخواه to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WpStickyBar: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6226 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WpStickyBar WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WpStickyBar
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Send email only on Reply to My Comment: Does not have CSRF check in some placesCVE-2024-6224 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Send email only on Reply to My Comment
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Send email only on Reply to My Comment: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6223 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Send email only on Reply to My Comment
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Donation Block For PayPal: Does not sanitise and escape form submissionsCVE-2024-6021 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site scripting vulnerability
- Product
- Donation Block For PayPal
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Donation Block For PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024CZ Loan Management: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5975 · WordPress plugins & themes · reported by WPScanCritical 9.1
The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- CZ Loan Management
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CZ Loan Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WP Ajax Contact Form: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5809 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users
- Product
- WP Ajax Contact Form
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WP Ajax Contact Form: Does not have CSRF check in placeCVE-2024-5808 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- WP Ajax Contact Form
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Business Card: Does not prevent high privilege users like administrators from uploading malicious PHP filesCVE-2024-5807 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.
- Product
- Business Card
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Business Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WpStickyBar: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5765 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- WpStickyBar
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Responsive Tabs: Does not sanitise and escape some of its Tab settingsCVE-2024-4096 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Tabs
- Affected
- up to 4.0.8
- What to do
- Affects up to 4.0.8. Update Responsive Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024SportsPress: Does not sanitise and escape some of its settingsCVE-2024-3986 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SportsPress
- Fixed in
- 2.7.22
- What to do
- Update SportsPress to 2.7.22 or newer.
Jul 30, 2024Web Directory Free: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3669 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Web Directory Free
- Fixed in
- 1.7.2
- What to do
- Update Web Directory Free to 1.7.2 or newer.
Jul 30, 2024FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection: Does not sanitise and escape some of its settingsCVE-2024-3113 · WordPress plugins & themes · reported by WPScanMedium 5.9
The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection
- Fixed in
- 2.12.2
- What to do
- Update FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection to 2.12.2 or newer.
Jul 30, 2024pmpro-member-directory: Does not prevent users with at least the contributor role from leaking other users' sensitive informationCVE-2024-1287 · WordPress plugins & themes · reported by WPScanMedium 6.5
The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.
- Product
- pmpro-member-directory
- Fixed in
- 1.2.6
- What to do
- Update pmpro-member-directory to 1.2.6 or newer.
Jul 30, 2024pmpro-membership-maps: Does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the siteCVE-2024-1286 · WordPress plugins & themes · reported by WPScanMedium 4.9
The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.
- Product
- pmpro-membership-maps
- Fixed in
- 0.7
- What to do
- Update pmpro-membership-maps to 0.7 or newer.
Jul 29, 2024Inline Related Posts: Does not sanitise and escape some of its settingsCVE-2024-6487 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Inline Related Posts
- Fixed in
- 3.8.0
- What to do
- Update Inline Related Posts to 3.8.0 or newer.
Jul 29, 2024User Profile Builder: Does not have proper authorisationCVE-2024-6366 · WordPress plugins & themes · reported by WPScanCritical 9.1
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
- Product
- User Profile Builder
- Fixed in
- 3.11.8
- What to do
- Update User Profile Builder to 3.11.8 or newer.
Jul 29, 2024Ultimate Blocks: Does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embedCVE-2024-6362 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Ultimate Blocks
- Fixed in
- 3.2.0
- What to do
- Update Ultimate Blocks to 3.2.0 or newer.
Jul 29, 2024Ultimate Classified Listings: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5883 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ultimate Classified Listings
- Fixed in
- 1.3
- What to do
- Update Ultimate Classified Listings to 1.3 or newer.
Jul 29, 2024The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PCVE-2024-5882 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PHP files on the server from the listings page
- Product
- Ultimate Classified Listings
- Fixed in
- 1.3
- What to do
- Update Ultimate Classified Listings to 1.3 or newer.
Jul 29, 2024wp-affiliate-platform: Does not have CSRF check in placeCVE-2024-5285 · WordPress plugins & themes · reported by WPScanMedium 5.5
The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logged in user change delete them via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.2
- What to do
- Update wp-affiliate-platform to 6.5.2 or newer.
Jul 29, 2024Email Encoder: Does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin pageCVE-2024-4483 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting
- Product
- Email Encoder
- Fixed in
- 2.2.2
- What to do
- Update Email Encoder to 2.2.2 or newer.
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6703 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ and 'btn_txt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for attackers with the Form Manager permissions and Subscriber+ user role, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024aThemes Starter Sites: Stored Cross-Site ScriptingCVE-2024-6897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- aThemes Starter Sites
- Affected
- up to 1.0.53
- What to do
- Affects up to 1.0.53. Update aThemes Starter Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024Happy Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-6627 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's PDF View widget in all versions up to, and including, 3.11.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.11.2
- What to do
- Affects up to 3.11.2. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6521 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dropdown fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6520 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom error message in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 27, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-6518 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via input fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 27, 2024Piotnet Addons For Elementor: Sensitive Information ExposureCVE-2024-5614 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'pafe_posts_list' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and excerpts of future, draft, and pending blog posts.
- Product
- Piotnet Addons For Elementor
- Affected
- up to 2.4.29
- What to do
- Affects up to 2.4.29. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024Campaign Monitor for: Full Path DisclosureCVE-2024-6569 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plugin not properly restricting direct access to /forms/views/admin/create.php and display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Campaign Monitor for
- Affected
- up to 2.8.15
- What to do
- Affects up to 2.8.15. Update Campaign Monitor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024WooCommerce Product Table Lite: Unauthorized post title modificationCVE-2024-6458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with subscriber access and above to change titles of arbitrary posts. Missing sanitization can lead to Stored Cross-Site Scripting when viewed by an admin via the WooCommerce Product Table.
- Product
- WooCommerce Product Table Lite
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024AIomatic - Automatic AI Content Writer: Arbitrary email sending vulnerabilityCVE-2024-5969 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This is due to insufficient limitations on the email recipient and the content in the 'aiomatic_send_email' function which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient.
- Product
- AIomatic - Automatic AI Content Writer
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update AIomatic - Automatic AI Content Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 26, 2024ParityPress – Parity Pricing with Discount Rules: Stored Cross-Site ScriptingCVE-2024-6661 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Discount Text' in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- ParityPress – Parity Pricing with Discount Rules
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update ParityPress – Parity Pricing with Discount Rules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 26, 2024Master Currency WP: Stored Cross-Site ScriptingCVE-2024-6634 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Currency WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currencyconverterform shortcode in all versions up to, and including, 1.1.61 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Master Currency WP
- Affected
- up to 1.1.61
- What to do
- Affects up to 1.1.61. Update Master Currency WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 26, 2024Ultimate WordPress Auction: Unauthorized email creation and sendingCVE-2024-6591 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.
- Product
- Ultimate WordPress Auction
- Affected
- up to 4.2.7
- What to do
- Affects up to 4.2.7. Update Ultimate WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 26, 2024Intelligence: Full Path DisclosureCVE-2024-6573 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plugin not preventing direct access to the /vendor/levelten/intel/realtime/index.php file and display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Intelligence
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Intelligence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 26, 2024Aramex Shipping WooCommerce: Full Path DisclosureCVE-2024-6566 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin not preventing direct access to the composer-setup.php file which also has display_errors enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Aramex Shipping WooCommerce
- Affected
- up to 1.1.21
- What to do
- Affects up to 1.1.21. Update Aramex Shipping WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 26, 2024Admin Post Navigation: Full Path DisclosureCVE-2024-6549 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Admin Post Navigation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Admin Post Navigation
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Admin Post Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 26, 2024Add Admin JavaScript: Full Path DisclosureCVE-2024-6548 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Add Admin JavaScript plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Add Admin JavaScript
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Add Admin JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.