Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

450new WordPress flaws this week

399,128entries in the database

41,580 results · page 592 of 832

Apr 26, 2024WordPress Ad Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33696 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet XPRESS WordPress Ad Widget allows Stored XSS.This issue affects WordPress Ad Widget: from n/a through 2.20.0.
Product
WordPress Ad Widget
Affected
up to 2.20.0
What to do
Affects up to 2.20.0. Update WordPress Ad Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Fan Page Widget by ThemeNcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33695 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode Fan Page Widget by ThemeNcode allows Stored XSS.This issue affects Fan Page Widget by ThemeNcode: from n/a through 2.0.
Product
Fan Page Widget by ThemeNcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update Fan Page Widget by ThemeNcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Meks ThemeForest Smart Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33694 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks ThemeForest Smart Widget allows Stored XSS.This issue affects Meks ThemeForest Smart Widget: from n/a through 1.5.
Product
Meks ThemeForest Smart Widget
Affected
up to 1.5
What to do
Affects up to 1.5. Update Meks ThemeForest Smart Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Meks Smart Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33693 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Smart Social Widget allows Stored XSS.This issue affects Meks Smart Social Widget: from n/a through 1.6.4.
Product
Meks Smart Social Widget
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Meks Smart Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Smart Recent Posts Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33692 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Satrya Smart Recent Posts Widget allows Stored XSS.This issue affects Smart Recent Posts Widget: from n/a through 1.0.3.
Product
Smart Recent Posts Widget
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Smart Recent Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024OptinMonster: Cross-Site Request Forgery (CSRF)CVE-2024-33691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in OptinMonster Popup Builder Team OptinMonster.This issue affects OptinMonster: from n/a through 2.15.3.
Product
OptinMonster
Affected
up to 2.15.3
What to do
Affects up to 2.15.3. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Financio: Cross-Site Request Forgery (CSRF)CVE-2024-33690 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jegstudio Financio.This issue affects Financio: from n/a through 1.1.3.
Product
Financio
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Financio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Radio Station: Cross-Site Request Forgery (CSRF)CVE-2024-33689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station.This issue affects Radio Station: from n/a through <= 2.5.7.
Product
Radio Station
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update Radio Station to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Teluro: Cross-Site Request Forgery (CSRF)CVE-2024-33688 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Teluro.This issue affects Teluro: from n/a through 1.0.31.
Product
Teluro
Affected
up to 1.0.31
What to do
Affects up to 1.0.31. Update Teluro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Reviews Plus: Missing AuthorizationCVE-2024-32822 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in impleCode Reviews Plus.This issue affects Reviews Plus: from n/a through 1.3.4.
Product
Reviews Plus
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Reviews Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Hide Dashboard Notifications: Cross-Site Request Forgery (CSRF)CVE-2024-33683 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Republic Hide Dashboard Notifications.This issue affects Hide Dashboard Notifications: from n/a through 1.2.3.
Product
Hide Dashboard Notifications
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Hide Dashboard Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024WP GDPR Compliance: Cross-Site Request Forgery (CSRF)CVE-2024-33682 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cookie Information A/S WP GDPR Compliance.This issue affects WP GDPR Compliance: from n/a through 2.0.23.
Product
WP GDPR Compliance
Affected
up to 2.0.23
What to do
Affects up to 2.0.23. Update WP GDPR Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024MainWP Child Reports: Cross-Site Request Forgery (CSRF)CVE-2024-33680 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.This issue affects MainWP Child Reports: from n/a through 2.1.1.
Product
MainWP Child Reports
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update MainWP Child Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024FameTheme Demo Importer: Cross-Site Request Forgery (CSRF)CVE-2024-33679 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in FameThemes FameTheme Demo Importer.This issue affects FameTheme Demo Importer: from n/a through 1.1.5.
Product
FameTheme Demo Importer
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update FameTheme Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024ClickCease Click Fraud Protection: Cross-Site Request Forgery (CSRF)CVE-2024-33678 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection.This issue affects ClickCease Click Fraud Protection: from n/a through <= 3.2.7.
Product
ClickCease Click Fraud Protection
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update ClickCease Click Fraud Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Contact Form 7 Extension For Mailchimp: Cross-Site Request Forgery (CSRF)CVE-2024-33677 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.
Product
Contact Form 7 Extension For Mailchimp
Affected
up to 0.5.70
What to do
Affects up to 0.5.70. Update Contact Form 7 Extension For Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Page Builder: Live Composer: Missing AuthorizationCVE-2024-32957 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.38.
Product
Page Builder: Live Composer
Affected
up to 1.5.38
What to do
Affects up to 1.5.38. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Data Tables Generator by Supsystic: Missing AuthorizationCVE-2024-32829 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.10.31.
Product
Data Tables Generator by Supsystic
Affected
up to 1.10.31
What to do
Affects up to 1.10.31. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Flexible Shipping: Missing AuthorizationCVE-2024-32828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Octolize Flexible Shipping.This issue affects Flexible Shipping: from n/a through 4.24.15.
Product
Flexible Shipping
Affected
up to 4.24.15
What to do
Affects up to 4.24.15. Update Flexible Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024VK Block Patterns: Missing AuthorizationCVE-2024-32826 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vektor,Inc. VK Block Patterns.This issue affects VK Block Patterns: from n/a through 1.31.0.
Product
VK Block Patterns
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update VK Block Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions uCVE-2024-3682 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wp-staging.com
Apr 26, 2024Product Addons & Fields for WooCommerce: Arbitrary file uploadsCVE-2024-3962 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires the PPOM Pro plugin to be installed along with a WooCommerce product that contains a file upload field to retrieve the correct nonce.
Product
Product Addons & Fields for WooCommerce
Affected
up to 32.0.18
What to do
Affects up to 32.0.18. Update Product Addons & Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org themeisle.com
Apr 26, 2024WP SMTP: SQL InjectionCVE-2024-1789 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP SMTP plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in versions 1.2 to 1.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP SMTP
Affected
1.2 to 1.2.6
What to do
Affects 1.2 to 1.2.6. Update WP SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 26, 2024Happy Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-3890 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up to, and including, 3.10.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Happy Addons for Elementor
Affected
up to 3.10.5
What to do
Affects up to 3.10.5. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 26, 2024Blog2Social: Social Media Auto Post & Scheduler: Sensitive Information ExposureCVE-2024-3678 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. This makes it possible for unauthenticated attackers to view limited information from password protected posts.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 26, 2024MF Gig Calendar: Cross-Site Request Forgery (CSRF)CVE-2024-33651 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar : from n/a through 1.2.1.
Product
MF Gig Calendar
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Serious Slider: Cross-Site Request Forgery (CSRF)CVE-2024-33650 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cryout Creations Serious Slider.This issue affects Serious Slider: from n/a through 1.2.4.
Product
Serious Slider
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Serious Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Advanced Post List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33642 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EkoJR Advanced Post List allows Stored XSS.This issue affects Advanced Post List: from n/a through 0.5.6.1.
Product
Advanced Post List
Affected
up to 0.5.6.1
What to do
Affects up to 0.5.6.1. Update Advanced Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024PopupAlly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33639 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects PopupAlly: from n/a through 2.1.1.
Product
PopupAlly
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update PopupAlly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Smart Maintenance Mode: Cross-Site Request Forgery (CSRF)CVE-2024-33638 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Brijesh Kothari Smart Maintenance Mode.This issue affects Smart Maintenance Mode: from n/a through 1.4.4.
Product
Smart Maintenance Mode
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Smart Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Annual Archive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33598 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue affects Annual Archive: from n/a through 1.6.0.
Product
Annual Archive
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Annual Archive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024WP-Members Membership: Information ExposureCVE-2024-2920 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.
Product
WP-Members Membership
Affected
up to 3.4.9.3
What to do
Affects up to 3.4.9.3. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Fixed in
7.1.0
What to do
Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024MM-email2image: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3075 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
MM-email2image
Affected
up to 0.2.5
What to do
Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024ENL Newsletter: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-3060 · WordPress plugins & themes · reported by WPScanMedium 4.5
The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks
Product
ENL Newsletter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024ENL Newsletter: Does not have CSRF checks in some placesCVE-2024-3059 · WordPress plugins & themes · reported by WPScanMedium 5.7
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack
Product
ENL Newsletter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024ENL Newsletter: Does not have CSRF check in some placesCVE-2024-3058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Product
ENL Newsletter
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Bannerlid: Does not escape generated URLs before outputting them in attributesCVE-2024-3048 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators
Product
Bannerlid
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Bannerlid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Call Now Button: Does not sanitise and escape some of its settingsCVE-2024-2908 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Call Now Button
Fixed in
1.4.7
What to do
Update Call Now Button to 1.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024WP Chat App: Does not sanitise and escape some of its settingsCVE-2024-2837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
WP Chat App
Fixed in
3.6.4
What to do
Update WP Chat App to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2603 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Salon booking system
Affected
up to 9.6.5
What to do
Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2439 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Salon booking system
Affected
up to 9.6.5
What to do
Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Salon booking system: Does not have CSRF check in placeCVE-2024-2429 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Salon booking system
Affected
up to 9.6.5
What to do
Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2024-2310 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Google Review Slider
Fixed in
13.6
What to do
Update WP Google Review Slider to 13.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2159 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Social Sharing
Fixed in
3.3.61
What to do
Update Social Sharing to 3.3.61 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Fancy Product Designer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0905 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users
Product
Fancy Product Designer
Fixed in
6.1.8
What to do
Update Fancy Product Designer to 6.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2024Advanced Search: Does not properly escape parameters appended to an SQL queryCVE-2024-3265 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
Product
Advanced Search
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Advanced Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2024Radio Player: Server-Side Request Forgery (SSRF)CVE-2024-33592 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Simple Membership: Stored Cross-Site ScriptingCVE-2024-3730 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Membership
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 25, 2024LoginPress Pro: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.