Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

493new WordPress flaws this week

398,769entries in the database

41,498 results · page 553 of 830

Jul 4, 2024Nested Pages: Cross-Site Request ForgeryCVE-2024-5943 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorrect nonce validation on the 'settingsPage' function and missing santization of the 'tab' parameter. This makes it possible for unauthenticated attackers to call local php files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Nested Pages
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2024Premium Addons for Elementor: Regular Expression Denial of Service (ReDoS)CVE-2024-6434 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10.35. This is due to processing user-supplied input as a regular expression. This makes it possible for authenticated attackers, with Author-level access and above, to create and query a malicious post title, resulting in slowing server resources.
Product
Premium Addons for Elementor
Affected
up to 4.10.35
What to do
Affects up to 4.10.35. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2024IMGspider: Arbitrary file uploadsCVE-2024-6319 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
IMGspider
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update IMGspider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2024IMGspider: Arbitrary file uploadsCVE-2024-6318 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
IMGspider
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update IMGspider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2024One Click Order Re-Order: Unauthorized modification of dataCVE-2024-5641 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ced_ocor_save_general_setting' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the plugin settings, including adding stored cross-site scripting.
Product
One Click Order Re-Order
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update One Click Order Re-Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-3639 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Posts Grid widget in all versions up to, and including, 8.3.7 due to insufficient input sanitization and output escaping on user supplied attributes like 'grid_skin'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.7
What to do
Affects up to 8.3.7. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 4, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-3638 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Marquee Text Widget, Testimonials Widget, and Testimonial Slider widgets in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-2926 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 8.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.7
What to do
Affects up to 8.3.7. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2024Elementor Addons by Livemesh: Local File InclusionCVE-2024-2385 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.4 via several of the plugin's widgets through the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVE-2024-37547 is likely a duplicate of this issue.
Product
Elementor Addons by Livemesh
Affected
up to 8.4
What to do
Affects up to 8.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2024A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0.CVE-2024-38345 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.1
A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 3, 2024A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4.CVE-2024-38344 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 3, 2024Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-6340 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.10.36 and fully patched in version 4.10.37.
Product
Premium Addons for Elementor
Affected
up to 4.10.36
What to do
Affects up to 4.10.36. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2024WP Lightbox 2: Stored Cross-Site ScriptingCVE-2024-6263 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 3.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Lightbox 2
Affected
up to 3.0.6.6
What to do
Affects up to 3.0.6.6. Update WP Lightbox 2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2024The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce: Stored Cross-Site ScriptingCVE-2024-4482 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied 'text_days' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 5.6.1
What to do
Affects up to 5.6.1. Update The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 3, 2024WPQA Builder: Does not have CSRF checks in some placesCVE-2024-2376 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Product
WPQA Builder
Fixed in
6.1.1
What to do
Update WPQA Builder to 6.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2024WPQA Builder: Does not sanitise and escape some of its Slider settingsCVE-2024-2375 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Product
WPQA Builder
Fixed in
6.1.1
What to do
Update WPQA Builder to 6.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack
Product
Himer
Fixed in
2.1.1
What to do
Update Himer to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2024Himer: Does not sanitise and escape some of its Post settingsCVE-2024-2234 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks
Product
Himer
Fixed in
2.1.1
What to do
Update Himer to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2233 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group
Product
Himer
Fixed in
2.1.1
What to do
Update Himer to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2024The allows any authenticated user to join a private group due to a missing authorization check on a functionCVE-2024-2231 · WordPress plugins & themes · reported by WPScanMedium 6.5
The allows any authenticated user to join a private group due to a missing authorization check on a function
Fixed in
2.1.1
What to do
Update the plugin to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2040 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack
Product
Himer
Fixed in
2.1.1
What to do
Update Himer to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 3, 2024Snippet Shortcodes: Cross-Site Request ForgeryCVE-2024-4543 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or incorrect nonce validation when adding or editing shortcodes. This makes it possible for unauthenticated attackers to modify shortcodes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Snippet Shortcodes
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Snippet Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2024Post Meta Data Manager: Stored Cross-Site ScriptingCVE-2024-6264 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Meta Data Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$meta_key’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Meta Data Manager
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Post Meta Data Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024LearnPress – WordPress LMS: Unauthenticated bypass to user registrationCVE-2024-6099 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'check_validate_fields' function in the checkout. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.8.1
What to do
Affects up to 4.2.6.8.1. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024LearnPress – WordPress LMS: Unauthorized user registrationCVE-2024-6088 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and including, 4.2.6.8.1. This makes it possible for unauthenticated attackers to bypass disabled user registration to create a new account with the default role.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.8.1
What to do
Affects up to 4.2.6.8.1. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Ultimate Blocks – WordPress Blocks: Stored Cross-Site ScriptingCVE-2024-4268 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37457 may be a duplicate of this issue.
Product
Ultimate Blocks – WordPress Blocks
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update Ultimate Blocks – WordPress Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Cost Calculator Builder: Unauthorized modification of dataCVE-2024-6012 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary posts and append arbitrary content to existing posts.
Product
Cost Calculator Builder
Affected
up to 3.2.12
What to do
Affects up to 3.2.12. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Cost Calculator Builder: Stored Cross-Site ScriptingCVE-2024-6011 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cost Calculator Builder
Affected
up to 3.2.12
What to do
Affects up to 3.2.12. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record drive.google.com plugins.trac.wordpress.org
Jul 2, 2024The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2024-5260 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘read_more_text’ parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Motors – Car Dealer, Classifieds & Listing: Unauthorized modification of dataCVE-2024-5545 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stm_edit_delete_user_car function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpublish arbitrary posts and pages.
Product
Motors – Car Dealer, Classifieds & Listing
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2024Media Library Assistant: Reflected Cross-Site ScriptingCVE-2024-5544 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Media Library Assistant
Affected
up to 3.17
What to do
Affects up to 3.17. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2024Rife Elementor Extensions & Templates: Stored Cross-Site ScriptingCVE-2024-5504 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within the plugin's Writing Effect Headline widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rife Elementor Extensions & Templates
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Rife Elementor Extensions & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Ultimate Blocks – WordPress Blocks: Stored Cross-Site ScriptingCVE-2024-3513 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag (postTitleTag) parameter in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-6362 appears to be a duplicate of this issue.
Product
Ultimate Blocks – WordPress Blocks
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update Ultimate Blocks – WordPress Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2024LA-Studio Element Kit for Elementor: Local File InclusionCVE-2024-37479 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "progress_type" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.3.8.1
What to do
Affects up to 1.3.8.1. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 2, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Time-based SQL InjectionCVE-2024-6172 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37252 appears to be a duplicate of this issue.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.25
What to do
Affects up to 5.7.25. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024Easy Google Maps: Stored Cross-Site ScriptingCVE-2024-5219 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feature in all versions up to, and including, 1.11.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Google Maps
Affected
up to 1.11.15
What to do
Affects up to 1.11.15. Update Easy Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024sitetweet: Does not have CSRF check in some placesCVE-2024-5767 · WordPress plugins & themes · reported by WPScanHigh 8.8
The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Product
sitetweet
Affected
up to 0.2
What to do
Affects up to 0.2. Update sitetweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 2, 2024Quiz and Survey Master (QSM): Is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX actionCVE-2024-5606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
Product
Quiz and Survey Master (QSM)
Fixed in
9.0.2
What to do
Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 2, 2024Rank Math SEO: Does not sanitise and escape some of its settingsCVE-2024-4627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings (by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO WordPress plugin before 1.0.219) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Rank Math SEO
Fixed in
1.0.219
What to do
Update Rank Math SEO to 1.0.219 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 2, 2024EazyDocs: Does not sanitise and escape some of its settingsCVE-2024-3999 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
EazyDocs
Fixed in
2.5.0
What to do
Update EazyDocs to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 2, 2024The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid: Stored Cross-Site ScriptingCVE-2024-1427 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the section title tag attribute in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2024LA-Studio Element Kit for Elementor: Local File InclusionCVE-2024-5349 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'map_style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.3.8.1
What to do
Affects up to 1.3.8.1. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2024Void Contact Form 7 Widget For Elementor Page Builder: Stored Cross-Site ScriptingCVE-2024-5419 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_redirect_page' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Void Contact Form 7 Widget For Elementor Page Builder
Affected
up to 2.4
What to do
Affects up to 2.4. Update Void Contact Form 7 Widget For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2024Boot Store: Stored Cross-Site ScriptingCVE-2024-5938 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Boot Store
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Boot Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Jul 1, 2024Basil recipe: Persistent Cross-Site Scripting (XSS)CVE-2024-39310 · WordPress plugins & themes · reported by GitHubMedium 5.4
The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue.
Product
Basil recipe
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Basil recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 1, 2024Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-6130 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Form Maker by 10Web
Fixed in
1.15.26
What to do
Update Form Maker by 10Web to 1.15.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 1, 2024Quiz and Survey Master (QSM): Does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embedCVE-2024-4934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Quiz and Survey Master (QSM)
Fixed in
9.0.2
What to do
Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 29, 2024WordPress Plugin for Google Maps – WP MAPS: SQL InjectionCVE-2024-2386 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WordPress Plugin for Google Maps – WP MAPS
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update WordPress Plugin for Google Maps – WP MAPS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 29, 2024Goya: Reflected Cross-Site ScriptingCVE-2023-4017 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Goya
Affected
up to 1.0.8.7
What to do
Affects up to 1.0.8.7. Update Goya to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record goya.everthemes.com themeforest.net
Jun 29, 2024Gutenberg Blocks with AI by Kadence WP – Page Builder Features: DOM-based Stored Cross-Site ScriptingCVE-2024-5819 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenberg Blocks with AI by Kadence WP – Page Builder Features
Affected
up to 3.2.45
What to do
Affects up to 3.2.45. Update Gutenberg Blocks with AI by Kadence WP – Page Builder Features to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.