Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

3,905 results · page 55 of 79

Jun 11, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-5530 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WL: Product Horizontal Filter widget in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2024Custom Field Template: Sensitive Information ExposureCVE-2023-6748 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata.
Product
Custom Field Template
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2024Contact Form Builder, Contact Widget: Improper Restriction of Excessive Authentication AttemptsCVE-2024-35747 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue affects Contact Form Builder, Contact Widget: from n/a through 2.1.7.
Product
Contact Form Builder, Contact Widget
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Contact Form Builder, Contact Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Easy Forms for Mailchimp: Missing AuthorizationCVE-2024-35742 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
Product
Easy Forms for Mailchimp
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024WP Time Slots Booking Form: Missing AuthorizationCVE-2024-35735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.11.
Product
WP Time Slots Booking Form
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Upload Fields for WPForms: Missing AuthorizationCVE-2024-35661 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2.
Product
Upload Fields for WPForms
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Upload Fields for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024ARForms: Missing AuthorizationCVE-2024-32705 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.
Product
ARForms
Affected
up to 6.4
What to do
Affects up to 6.4. Update ARForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024ARForms: Missing AuthorizationCVE-2024-32704 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.
Product
ARForms
Affected
up to 6.4
What to do
Affects up to 6.4. Update ARForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024ARForms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-32703 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.
Product
ARForms
Affected
up to 6.4
What to do
Affects up to 6.4. Update ARForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024RomethemeForm For Elementor: Missing AuthorizationCVE-2024-32727 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rometheme RomethemeForm For Elementor.This issue affects RomethemeForm For Elementor: from n/a through 1.1.2.
Product
RomethemeForm For Elementor
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update RomethemeForm For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024USPS Shipping for WooCommerce – Live Rates: Insertion of Sensitive Information into Log FileCVE-2024-32811 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.4.
Product
USPS Shipping for WooCommerce – Live Rates
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update USPS Shipping for WooCommerce – Live Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024WP Time Slots Booking Form: Missing AuthorizationCVE-2024-33543 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.06.
Product
WP Time Slots Booking Form
Affected
up to 1.2.06
What to do
Affects up to 1.2.06. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024weForms: Missing AuthorizationCVE-2024-30512 · WordPress plugins & themes · reported by PatchstackLow 3.7
Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.20.
Product
weForms
Affected
up to 1.6.20
What to do
Affects up to 1.6.20. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Contact Form to DB by BestWebSoft: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-35678 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft.This issue affects Contact Form to DB by BestWebSoft: from n/a through 1.7.2.
Product
Contact Form to DB by BestWebSoft
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Contact Form to DB by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Widget Options - Extended: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35691 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - Extended: from n/a through 5.1.0.
Product
Widget Options - Extended
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Widget Options - Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Otter Blocks PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35682 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11.
Product
Otter Blocks PRO
Affected
up to 2.6.11
What to do
Affects up to 2.6.11. Update Otter Blocks PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Podlove Web Player: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35710 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through 5.7.3.
Product
Podlove Web Player
Affected
up to 5.7.3
What to do
Affects up to 5.7.3. Update Podlove Web Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024WP Time Slots Booking Form: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35734 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople WP Time Slots Booking Form allows Stored XSS.This issue affects WP Time Slots Booking Form: from n/a through 1.2.10.
Product
WP Time Slots Booking Form
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Formula: Reflected Cross-Site ScriptingCVE-2024-5638 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ti_customizer_notify_dismiss_recommended_plugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Formula
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update Formula to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Jun 8, 2024Formula: Reflected Cross-Site ScriptingCVE-2024-5613 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dismiss_action' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Formula
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update Formula to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Jun 7, 2024FileOrganizer – Manage WordPress and Website Files: Sensitive Information ExposureCVE-2024-5599 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizer_ajax_handler' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive information if the files have been moved to the built-in Trash folder.
Product
FileOrganizer – Manage WordPress and Website Files
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024WS Form LITE: CSV InjectionCVE-2023-5424 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Product
WS Form LITE
Affected
up to 1.9.217
What to do
Affects up to 1.9.217. Update WS Form LITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wsform.com
Jun 7, 2024ARForms - Premium WordPress Form Builder: Does not sanitise and escape some of its settingsCVE-2024-4621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
ARForms - Premium WordPress Form Builder
Fixed in
6.6
What to do
Update ARForms - Premium WordPress Form Builder to 6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2024ARForms - Premium WordPress Form Builder: Allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploadedCVE-2024-4620 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form
Product
ARForms - Premium WordPress Form Builder
Fixed in
6.6
What to do
Update ARForms - Premium WordPress Form Builder to 6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 7, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks: Stored Cross-Site ScriptingCVE-2024-4042 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the menu-wrap-item block in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Affected
up to 2.2.80
What to do
Affects up to 2.2.80. Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 7, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks: Stored Cross-Site ScriptingCVE-2024-1988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute in blocks in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Affected
up to 2.2.80
What to do
Affects up to 2.2.80. Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2024Login/Signup Popup ( Inline Form + Woocommerce ): Unauthorized access of dataCVE-2024-5665 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary options on affected sites.
Product
Login/Signup Popup ( Inline Form + Woocommerce )
Affected
2.7.1 to 2.7.2
What to do
Affects 2.7.1 to 2.7.2. Update Login/Signup Popup ( Inline Form + Woocommerce ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024Open Graph: Sensitive Information ExposureCVE-2024-5615 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'opengraph_default_description' function. This makes it possible for unauthenticated attackers to extract sensitive data including partial content of password-protected blog posts.
Product
Open Graph
Affected
up to 1.11.2
What to do
Affects up to 1.11.2. Update Open Graph to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2024BuddyPress Members Only: Sensitive Information ExposureCVE-2024-0972 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "All Other Sections On Your Site Will be Opened to Guest" feature (when unset) and view restricted page and post content.
Product
BuddyPress Members Only
Affected
up to 3.4.9
What to do
Affects up to 3.4.9. Update BuddyPress Members Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024Restrict for Elementor: Sensitive Information ExposureCVE-2024-0910 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract potentially sensitive data from post content.
Product
Restrict for Elementor
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Restrict for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 5, 2024Mollie Forms: Cross-Site Request ForgeryCVE-2024-2368 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mollie Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.13. This is due to missing or incorrect nonce validation on the duplicateForm() function. This makes it possible for unauthenticated attackers to duplicate forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Mollie Forms
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update Mollie Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 5, 2024BuddyForms: Email Verification BypassCVE-2024-5149 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.
Product
BuddyForms
Affected
up to 2.8.9
What to do
Affects up to 2.8.9. Update BuddyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024LearnPress – WordPress LMS: Sensitive Information ExposureCVE-2024-5483 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of get_items_permissions_check function. This makes it possible for unauthenticated attackers to extract basic information about website users, including their emails
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.8
What to do
Affects up to 4.2.6.8. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 4, 2024Easy Forms for Mailchimp: Insertion of Sensitive Information into Log FileCVE-2024-25095 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
Product
Easy Forms for Mailchimp
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue allows Reflected XSS.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.77.
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Affected
up to 3.1.77
What to do
Affects up to 3.1.77. Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024All In One WP Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52147 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4.
Product
All In One WP Security & Firewall
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update All In One WP Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Ultimate Dashboard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49822 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Vongries Ultimate Dashboard allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ultimate Dashboard: from n/a through 3.7.10.
Product
Ultimate Dashboard
Affected
up to 3.7.10
What to do
Affects up to 3.7.10. Update Ultimate Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Photo Album Plus: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49774 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
Product
WP Photo Album Plus
Affected
up to 8.5.02.005
What to do
Affects up to 8.5.02.005. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WPS Hide Login: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49748 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPServeur, NicolasKulka, wpformation WPS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPS Hide Login: from n/a through 1.9.11.
Product
WPS Hide Login
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Hide login page: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-48335 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Webcraftic Hide login page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hide login page: from n/a through 1.1.9.
Product
Hide login page
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Hide login page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Contact Form Email: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48318 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.
Product
Contact Form Email
Affected
up to 1.3.41
What to do
Affects up to 1.3.41. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Form Maker by 10Web: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48290 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20.
Product
Form Maker by 10Web
Affected
up to 1.15.20
What to do
Affects up to 1.15.20. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Forms Puzzle Captcha: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
Product
WP Forms Puzzle Captcha
Affected
up to 4.1
What to do
Affects up to 4.1. Update WP Forms Puzzle Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024LWS Hide Login: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-47818 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in LWS LWS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LWS Hide Login: from n/a through 2.1.8.
Product
LWS Hide Login
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update LWS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Captcha/Honeypot for Contact Form 7: Improper Restriction of Excessive Authentication AttemptsCVE-2023-45009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Forge12 Interactive GmbH Captcha/Honeypot for Contact Form 7 allows Functionality Bypass.This issue affects Captcha/Honeypot for Contact Form 7: from n/a through 1.11.3.
Product
Captcha/Honeypot for Contact Form 7
Affected
up to 1.11.3
What to do
Affects up to 1.11.3. Update Captcha/Honeypot for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Contact Form Email: Missing AuthorizationCVE-2023-28494 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31.
Product
Contact Form Email
Affected
up to 1.3.31
What to do
Affects up to 1.3.31. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024FS Product Inquiry: Does not sanitise and escape some form submissionsCVE-2024-4857 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape some form submissions, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
Product
FS Product Inquiry
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update FS Product Inquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included inCVE-2024-4750 · WordPress plugins & themes · reported by WPScanMedium 5.3
The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included in the request
Product
buddyboss-platform
Fixed in
2.6.0
What to do
Update buddyboss-platform to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 3, 2024Frontend Registration – Contact Form 7: Privilege escalationCVE-2024-4870 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend Registration – Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient restriction on the '_cf7frr_' post meta. This makes it possible for authenticated attackers, with editor-level access and above, to modify the default user role in the registration form settings.
Product
Frontend Registration – Contact Form 7
Affected
up to 5.1
What to do
Affects up to 5.1. Update Frontend Registration – Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 3, 2024CP Contact Form with Paypal: Missing AuthorizationCVE-2023-27460 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople, paypaldev CP Contact Form with Paypal allows Functionality Misuse.This issue affects CP Contact Form with Paypal: from n/a through 1.3.34.
Product
CP Contact Form with Paypal
Affected
up to 1.3.34
What to do
Affects up to 1.3.34. Update CP Contact Form with Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.