Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

493new WordPress flaws this week

398,769entries in the database

41,498 results · page 556 of 830

Jun 21, 2024Event Management Tickets Booking: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-5059 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A WP Life Event Management Tickets Booking.This issue affects Event Management Tickets Booking: from n/a through 1.4.0.
Product
Event Management Tickets Booking
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Event Management Tickets Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024phpinfo() WP: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35776 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exeebit phpinfo() WP.This issue affects phpinfo() WP: from n/a through 5.0.
Product
phpinfo() WP
Affected
up to 5.0
What to do
Affects up to 5.0. Update phpinfo() WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Hueman: Cross-Site Request Forgery (CSRF)CVE-2024-35772 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Hueman.This issue affects Hueman: from n/a through 3.7.24.
Product
Hueman
Affected
up to 3.7.24
What to do
Affects up to 3.7.24. Update Hueman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Customizr: Cross-Site Request Forgery (CSRF)CVE-2024-35771 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Customizr.This issue affects Customizr: from n/a through 4.4.21.
Product
Customizr
Affected
up to 4.4.21
What to do
Affects up to 4.4.21. Update Customizr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Vimeography: Vimeo Video Gallery: Cross-Site Request Forgery (CSRF)CVE-2024-35770 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeography: Vimeo Video Gallery WordPress Plugin: from n/a through 2.4.1.
Product
Vimeography: Vimeo Video Gallery
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Vimeography: Vimeo Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Page Builder: Live Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35768 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows DOM-Based XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22.
Product
Page Builder: Live Composer
Affected
up to 2.1.22
What to do
Affects up to 2.1.22. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024WPPizza: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35766 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ollybach WPPizza allows Reflected XSS.This issue affects WPPizza: from n/a through 3.18.13.
Product
WPPizza
Affected
up to 3.18.13
What to do
Affects up to 3.18.13. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Church Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35764 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.
Product
Church Admin
Affected
up to 4.4.4
What to do
Affects up to 4.4.4. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Excellent: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35763 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Excellent allows Stored XSS.This issue affects Excellent: from n/a through 1.2.9.
Product
Excellent
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Excellent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Serious Slider: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35762 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Cryout Creations Serious Slider allows Stored XSS.This issue affects Serious Slider: from n/a through 1.2.4.
Product
Serious Slider
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Serious Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35761 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Stored XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.0.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.4.0
What to do
Affects up to 4.4.0. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35760 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal allows DOM-Based XSS.This issue affects WP Job Portal: from n/a through <= 2.1.3.
Product
WP Job Portal
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35759 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.3.
Product
WP Job Portal
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Interface: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Horse Interface allows Stored XSS.This issue affects Interface: from n/a through 3.1.0.
Product
Interface
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Easy Age Verify: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35757 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 5 Star Plugins Easy Age Verify allows Stored XSS.This issue affects Easy Age Verify: from n/a through 1.8.2.
Product
Easy Age Verify
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Easy Age Verify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Typing Text: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-5058 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper Typing Text allows Stored XSS.This issue affects Typing Text: from n/a through 1.2.5.
Product
Typing Text
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Typing Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Page Builder: Live Composer: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35779 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 1.5.42.
Product
Page Builder: Live Composer
Affected
up to 1.5.42
What to do
Affects up to 1.5.42. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024DImage 360: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35774 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in D’arteweb DImage 360 allows Stored XSS.This issue affects DImage 360: from n/a through 2.0.
Product
DImage 360
Affected
up to 2.0
What to do
Affects up to 2.0. Update DImage 360 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Slideshow SE: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35769 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in John West Slideshow SE allows Stored XSS.This issue affects Slideshow SE: from n/a through 2.5.17.
Product
Slideshow SE
Affected
up to 2.5.17
What to do
Affects up to 2.5.17. Update Slideshow SE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Themify – WooCommerce Product Filter: Time-based SQL InjectionCVE-2024-6027 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Themify – WooCommerce Product Filter
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Themify – WooCommerce Product Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Reflected Cross-Site ScriptingCVE-2024-5859 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘d’ parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 21, 2024Booking for Appointments and Events Calendar – Amelia: Stored Cross-Site ScriptingCVE-2024-6225 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.5 (and 7.5.1 for the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 21, 2024WP SVG Images: Stored Cross-Site ScriptingCVE-2024-5945 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissions to upload sanitized files, to bypass SVG sanitization and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A bypass to the patch in version 4.3 was discovered and fixed completely in version 4.4.
Product
WP SVG Images
Affected
up to 4.3
What to do
Affects up to 4.3. Update WP SVG Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024User Profile Picture: Insecure Direct Object ReferenceCVE-2024-5639 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update the profile picture of any user.
Product
User Profile Picture
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update User Profile Picture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024Branda – White Label WordPress, Custom Login Page Customizer: Stored Cross-Site ScriptingCVE-2024-5191 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mime_types’ parameter in all versions up to, and including, 3.4.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Branda – White Label WordPress, Custom Login Page Customizer
Affected
up to 3.4.17
What to do
Affects up to 3.4.17. Update Branda – White Label WordPress, Custom Login Page Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5448 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
Affected
up to 1.7
What to do
Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Does not sanitise and escape some of its settingsCVE-2024-5447 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
Affected
up to 1.7
What to do
Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024Widget Bundle: Does not sanitise and escape some of its settingsCVE-2024-4970 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Widget Bundle
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Widget Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024Widget Bundle: Does not have CSRF checksCVE-2024-4969 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Widget Bundle WordPress plugin through 2.0.0 does not have CSRF checks when logging Widgets, which could allow attackers to make logged in admin enable/disable widgets via a CSRF attack
Product
Widget Bundle
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Widget Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024Google CSE: Does not sanitise and escape some of its settingsCVE-2024-4755 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Google CSE
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Google CSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024Widget Bundle: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4616 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users
Product
Widget Bundle
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Widget Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024WP Logs Book: Does not sanitise and escape some of its log data before outputting them back in an admin dashboardCVE-2024-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting
Product
WP Logs Book
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024WP Logs Book: Does not have CSRF checkCVE-2024-4475 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check when clearing logs, which could allow attackers to make a logged in admin clear the logs them via a CSRF attack
Product
WP Logs Book
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024WP Logs Book: Does not have CSRF check in placeCVE-2024-4474 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP Logs Book
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024CSSable Countdown: Does not sanitise and escape some of its settingsCVE-2024-4384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
CSSable Countdown
Affected
up to 1.5
What to do
Affects up to 1.5. Update CSSable Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024CB (legacy): Does not have CSRF checks in some bulk actionsCVE-2024-4382 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings via CSRF attacks
Product
CB (legacy)
Affected
up to 0.9.4.18
What to do
Affects up to 0.9.4.18. Update CB (legacy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024CB (legacy): Does not sanitise and escape some of its settingsCVE-2024-4381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
CB (legacy)
Affected
up to 0.9.4.18
What to do
Affects up to 0.9.4.18. Update CB (legacy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024DOP Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-4377 · WordPress plugins & themes · reported by WPScanMedium 5.4
The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
DOP Shortcodes
Affected
up to 1.2
What to do
Affects up to 1.2. Update DOP Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Time-based SQL InjectionCVE-2024-5756 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.23
What to do
Affects up to 5.7.23. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024Plus Addons for Elementor Page Builder: Local File InclusionCVE-2024-5455 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazine_style' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Plus Addons for Elementor Page Builder
Affected
up to 5.5.4
What to do
Affects up to 5.5.4. Update Plus Addons for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record roadmap.theplusaddons.com wordfence.com
Jun 21, 2024ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages: Unauthorized modification of dataCVE-2024-3961 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tag_subscriber function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to subscribe users to tags. Financial damages may occur to site owners if their API quota is exceeded.
Product
ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 20, 2024WP Blog Post Layouts: Local File InclusionCVE-2024-5503 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
WP Blog Post Layouts
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update WP Blog Post Layouts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024The Plus Addons for Elementor Page Builder: Reflected Cross-Site ScriptingCVE-2024-5344 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the plugin's WP Login & Register widget in all versions up to, and including, 5.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
The Plus Addons for Elementor Page Builder
Affected
up to 5.5.6
What to do
Affects up to 5.5.6. Update The Plus Addons for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record roadmap.theplusaddons.com wordfence.com
Jun 20, 2024WP Child Theme Generator: Unauthorized modification of dataCVE-2024-3610 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_theme() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child theme and activate it cause the site to whitescreen.
Product
WP Child Theme Generator
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Child Theme Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024Hide Dashboard Notifications: Unauthorized modification of dataCVE-2024-1955 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_notices_settings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's settings.
Product
Hide Dashboard Notifications
Affected
up to 1.3
What to do
Affects up to 1.3. Update Hide Dashboard Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024License Manager for WooCommerce: Unauthorized access of dataCVE-2024-1639 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.6. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the "license" JS variable. Please note that the version in trunk is patched, however, the 3.0.7 tagged version is not.
Product
License Manager for WooCommerce
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update License Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024Smush: Unauthorized deletion of the resmush listCVE-2023-3352 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.
Product
Smush
What to do
Update Smush to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 20, 2024Master Slider: Cross Site Scripting (XSS)CVE-2024-37222 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross Site Scripting (XSS) vulnerability in Averta Master Slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.10.0.
Product
Master Slider
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 20, 2024Flatsome: Stored Cross-Site ScriptingCVE-2024-5156 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.18.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flatsome
Affected
up to 3.18.7
What to do
Affects up to 3.18.7. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 20, 2024The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2024-5036 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.