Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

427new WordPress flaws this week

399,128entries in the database

41,580 results · page 595 of 832

Apr 23, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-3491 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.29
What to do
Affects up to 1.29. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2024GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: Stored Cross-Site ScriptingCVE-2024-3732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GeoDirectory – WordPress Business Directory Plugin, or Classified Directory
Affected
up to 2.3.48
What to do
Affects up to 2.3.48. Update GeoDirectory – WordPress Business Directory Plugin, or Classified Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2024Rank Math SEO with AI SEO Tools: Stored Cross-Site ScriptingCVE-2024-3665 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's HowTo and FAQ widgets in all versions up to, and including, 1.0.216 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rank Math SEO with AI SEO Tools
Affected
up to 1.0.216
What to do
Affects up to 1.0.216. Update Rank Math SEO with AI SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 23, 2024The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits.CVE-2024-0900 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress is vulnerable to unauthorized post creation due to a missing capability check on the elespare_create_post() function hooked via AJAX in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary posts.
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2024Quick Featured Images: Unauthorized modification of dataCVE-2024-3664 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and delete_thumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author.
Product
Quick Featured Images
Affected
up to 13.7.0
What to do
Affects up to 13.7.0. Update Quick Featured Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-3889 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Accordion widget in all versions up to, and including, 1.3.971 due to insufficient input sanitization and output escaping on user supplied attributes like 'accordion_title_tag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.971
What to do
Affects up to 1.3.971. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-2799 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid & Advanced Text widget HTML tags in all versions up to, and including, 1.3.96 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.96
What to do
Affects up to 1.3.96. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 23, 2024Royal Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2024-2798 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget containers in all versions up to, and including, 1.3.971 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.971
What to do
Affects up to 1.3.971. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2024Forminator prior to 1.15.4 contains a cross-site scripting vulnerability.CVE-2024-31857 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser.
Fixed in
1.15.4
What to do
Update the plugin to 1.15.4 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 23, 2024Forminator prior to 1.29.3 contains a SQL injection vulnerability.CVE-2024-31077 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.2
Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) condition.
Fixed in
1.29.3
What to do
Update the plugin to 1.29.3 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 23, 2024Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability.CVE-2024-28890 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.3
Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.
Fixed in
1.29.0
What to do
Update the plugin to 1.29.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Apr 22, 2024rtMedia for WordPress, BuddyPress and bbPress: Blind SQL InjectionCVE-2024-3293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to blind SQL Injection via the rtmedia_gallery shortcode in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
rtMedia for WordPress, BuddyPress and bbPress
Affected
up to 4.6.18
What to do
Affects up to 4.6.18. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 22, 2024Essential Addons for Elementor Pro: Stored Cross-Site ScriptingCVE-2024-3645 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Counter widget in all versions up to, and including, 5.8.11 due to insufficient input sanitization and output escaping on user supplied attributes such as 'title_html_tag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor Pro
Affected
up to 5.8.11
What to do
Affects up to 5.8.11. Update Essential Addons for Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record essential-addons.com wordfence.com
Apr 22, 2024Active Products Tables for WooCommerce: Missing AuthorizationCVE-2024-32691 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in realmag777 Active Products Tables for WooCommerce.This issue affects Active Products Tables for WooCommerce: from n/a through 1.0.6.2.
Product
Active Products Tables for WooCommerce
Affected
up to 1.0.6.2
What to do
Affects up to 1.0.6.2. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024MyRewards: Missing AuthorizationCVE-2024-32688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Long Watch Studio MyRewards.This issue affects MyRewards: from n/a through 5.3.0.
Product
MyRewards
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update MyRewards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024WPC Frequently Bought Together for WooCommerce: Missing AuthorizationCVE-2024-32687 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.0.3.
Product
WPC Frequently Bought Together for WooCommerce
Affected
up to 7.0.3
What to do
Affects up to 7.0.3. Update WPC Frequently Bought Together for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Wp Ultimate Review: Missing AuthorizationCVE-2024-32684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
Product
Wp Ultimate Review
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Prime Slider – Addons For Elementor: Missing AuthorizationCVE-2024-32682 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
Product
Prime Slider – Addons For Elementor
Affected
up to 3.13.2
What to do
Affects up to 3.13.2. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Prime Slider – Addons For Elementor: Missing AuthorizationCVE-2024-32681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
Product
Prime Slider – Addons For Elementor
Affected
up to 3.13.2
What to do
Affects up to 3.13.2. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32698 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a through <= 3.10.4.
Product
Happy Addons for Elementor
Affected
up to 3.10.4
What to do
Affects up to 3.10.4. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024HelloAsso: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso allows Stored XSS.This issue affects HelloAsso: from n/a through 1.1.5.
Product
HelloAsso
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update HelloAsso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Infographic Maker – iList: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32696 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Infographic Maker – iList allows Stored XSS.This issue affects Infographic Maker – iList: from n/a through 4.6.6.
Product
Infographic Maker – iList
Affected
up to 4.6.6
What to do
Affects up to 4.6.6. Update Infographic Maker – iList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Language Switcher for Transposh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Gasi Language Switcher for Transposh allows Reflected XSS.This issue affects Language Switcher for Transposh: from n/a through 1.5.9.
Product
Language Switcher for Transposh
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Language Switcher for Transposh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 20243D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Reflected XSS.This issue affects 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin: from n/a through 3.62.
Product
3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook
Affected
up to 3.62
What to do
Affects up to 3.62. Update 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Automatic: Cross-Site Request Forgery (CSRF)CVE-2024-32693 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Cross-Site Request Forgery (CSRF) vulnerability in ValvePress Automatic.This issue affects Automatic: from n/a before 3.93.0.
Product
Automatic
Fixed in
3.93.0
What to do
Update Automatic to 3.93.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024RSS Feed Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32690 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood RSS Feed Widget allows Stored XSS.This issue affects RSS Feed Widget: from n/a through 2.9.7.
Product
RSS Feed Widget
Affected
up to 2.9.7
What to do
Affects up to 2.9.7. Update RSS Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 22, 2024Tickera: Does not prevent users from leaking other users' ticketsCVE-2023-7252 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets.
Product
Tickera
Fixed in
3.5.2.5
What to do
Update Tickera to 3.5.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 21, 2024A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress.CVE-2015-10132 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin.php. The manipulation of the argument Spreadplugin leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.8.6.6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-261676.
Affected
up to 3.8.6.1
What to do
Affects up to 3.8.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Apr 20, 2024hCaptcha for: Stored Cross-Site ScriptingCVE-2024-4014 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
hCaptcha for
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update hCaptcha for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 20, 2024The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) plCVE-2024-1730 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via urls in link fields, images from URLs, and html tags used in widgets in all versions up to, and including, 3.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.14.0
What to do
Affects up to 3.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 19, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-1057 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishsuite_button' shortcode in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attributes like 'button_class'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor)
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 19, 2024Wp Ultimate Review: Authorization Bypass Through User-Controlled KeyCVE-2024-32683 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Wpmet Wp Ultimate Review.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
Product
Wp Ultimate Review
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 19, 2024Genesis Blocks: Does not properly escape data input provided to some of its blocksCVE-2024-2761 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks.
Product
Genesis Blocks
Fixed in
3.1.3
What to do
Update Genesis Blocks to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2024Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2024-3818 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Social Icons" block in all versions up to, and including, 4.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 4.5.9
What to do
Affects up to 4.5.9. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2024Customer Reviews for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-3731 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.47.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Customer Reviews for WooCommerce
Affected
up to 5.47.0
What to do
Affects up to 5.47.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2024Media Library Folders: Reflected Cross-Site ScriptingCVE-2024-3615 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 8.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Media Library Folders
Affected
up to 8.2.0
What to do
Affects up to 8.2.0. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2024Poll Maker – Best WordPress Poll: Stored Cross-Site ScriptingCVE-2024-3600 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the ays_poll_maker_quick_start AJAX action in addition to insufficient escaping and sanitization in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to create quizzes and inject malicious web scripts into them that execute when a user visits the page.
Product
Poll Maker – Best WordPress Poll
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update Poll Maker – Best WordPress Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2024ElementsKit Pro: Stored Cross-Site ScriptingCVE-2024-3598 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ElementsKit Pro
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update ElementsKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmet.com wordfence.com
Apr 18, 2024LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-3560 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.4
What to do
Affects up to 4.2.6.4. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2024WP Social Comments: Missing AuthorizationCVE-2024-32689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GenialSouls WP Social Comments.This issue affects WP Social Comments: from n/a through 1.7.3.
Product
WP Social Comments
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update WP Social Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Backup Migration: Insertion of Sensitive Information into Log FileCVE-2024-32686 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.
Product
Backup Migration
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024WooCommerce Multilingual & Multicurrency: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32602 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.3.1.
Product
WooCommerce Multilingual & Multicurrency
Affected
up to 5.3.3.1
What to do
Affects up to 5.3.3.1. Update WooCommerce Multilingual & Multicurrency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Master Slider: Deserialization of Untrusted DataCVE-2024-32600 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.5.
Product
Master Slider
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Superfly Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in looks_awesome Superfly Menu superfly-menu.This issue affects Superfly Menu: from n/a through <= 5.0.25.
Product
Superfly Menu
Affected
up to 5.0.25
What to do
Affects up to 5.0.25. Update Superfly Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Taggbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32552 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tagbox Taggbox allows Stored XSS.This issue affects Taggbox: from n/a through 3.2.
Product
Taggbox
Affected
up to 3.2
What to do
Affects up to 3.2. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024SP Project & Document Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32551 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager : from n/a through 4.71.
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Navigation menu as Dropdown Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32126 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Navigation menu as Dropdown Widget navigation-menu-as-dropdown-widget.This issue affects Navigation menu as Dropdown Widget: from n/a through <= 1.3.4.
Product
Navigation menu as Dropdown Widget
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Navigation menu as Dropdown Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024Really Simple SSL: Server-Side Request Forgery (SSRF)CVE-2024-31229 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3.
Product
Really Simple SSL
Affected
up to 7.2.3
What to do
Affects up to 7.2.3. Update Really Simple SSL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024EAN for WooCommerce: Insecure Direct Object ReferenceCVE-2023-6897 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.
Product
EAN for WooCommerce
Affected
up to 4.9.2
What to do
Affects up to 4.9.2. Update EAN for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2024EAN for WooCommerce: Stored Cross-Site ScriptingCVE-2023-6892 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EAN for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_ean_product_meta' shortcode in all versions up to, and including, 4.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
EAN for WooCommerce
Affected
up to 4.8.7
What to do
Affects up to 4.8.7. Update EAN for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.