Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

422new WordPress flaws this week

399,128entries in the database

41,580 results · page 634 of 832

Jan 31, 2024WP To Do: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22292 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.2.8.
Product
WP To Do
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update WP To Do to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Post views Stats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberNetikz Post views Stats post-views-stats allows DOM-Based XSS.This issue affects Post views Stats: from n/a through <= 1.4.1.
Product
Post views Stats
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Post views Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024BA Plus – Before & After Image Slider FREE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22286 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aluka BA Plus – Before & After Image Slider FREE allows Reflected XSS.This issue affects BA Plus – Before & After Image Slider FREE: from n/a through 1.0.3.
Product
BA Plus – Before & After Image Slider FREE
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update BA Plus – Before & After Image Slider FREE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024SimpleMap Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22282 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Torbert SimpleMap Store Locator allows Reflected XSS.This issue affects SimpleMap Store Locator: from n/a through 2.6.1.
Product
SimpleMap Store Locator
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update SimpleMap Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Shield Security – Smart Bot Blocking & Intrusion Prevention Security: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22163 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shield Security Shield Security – Smart Bot Blocking & Intrusion Prevention Security allows Stored XSS.This issue affects Shield Security – Smart Bot Blocking & Intrusion Prevention Security: from n/a through 18.5.7.
Product
Shield Security – Smart Bot Blocking & Intrusion Prevention Security
Affected
up to 18.5.7
What to do
Affects up to 18.5.7. Update Shield Security – Smart Bot Blocking & Intrusion Prevention Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WPZOOM Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22162 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Shortcodes allows Reflected XSS.This issue affects WPZOOM Shortcodes: from n/a through 1.0.3.
Product
WPZOOM Shortcodes
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WPZOOM Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024HD Quiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22161 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harmonic Design HD Quiz allows Stored XSS.This issue affects HD Quiz: from n/a through 1.8.11.
Product
HD Quiz
Affected
up to 1.8.11
What to do
Affects up to 1.8.11. Update HD Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Image Tag Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22160 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bradley B. Dalina Image Tag Manager allows Reflected XSS.This issue affects Image Tag Manager: from n/a through 1.5.
Product
Image Tag Manager
Affected
up to 1.5
What to do
Affects up to 1.5. Update Image Tag Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Formzu WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formzu Inc. Formzu WP allows Stored XSS.This issue affects Formzu WP: from n/a through 1.6.7.
Product
Formzu WP
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update Formzu WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WP-Lister Lite for eBay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22307 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.5.7.
Product
WP-Lister Lite for eBay
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Mang Board WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22306 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hometory Mang Board WP allows Stored XSS.This issue affects Mang Board WP: from n/a through 1.7.7.
Product
Mang Board WP
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Albo Pretorio On line: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22302 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignazio Scimone Albo Pretorio On line allows Stored XSS.This issue affects Albo Pretorio On line: from n/a through 4.6.6.
Product
Albo Pretorio On line
Affected
up to 4.6.6
What to do
Affects up to 4.6.6. Update Albo Pretorio On line to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024PDF Poster – PDF Embedder Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-23508 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17.
Product
PDF Poster – PDF Embedder Plugin for
Affected
up to 2.1.17
What to do
Affects up to 2.1.17. Update PDF Poster – PDF Embedder Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024PDF Viewer & 3D PDF Flipbook – DearPDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-23505 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive PDF Viewer & 3D PDF Flipbook – DearPDF allows Stored XSS.This issue affects PDF Viewer & 3D PDF Flipbook – DearPDF: from n/a through 2.0.38.
Product
PDF Viewer & 3D PDF Flipbook – DearPDF
Affected
up to 2.0.38
What to do
Affects up to 2.0.38. Update PDF Viewer & 3D PDF Flipbook – DearPDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Posts List Designer by Category – List Category Posts Or Recent Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-23502 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in InfornWeb Posts List Designer by Category – List Category Posts Or Recent Posts allows Stored XSS.This issue affects Posts List Designer by Category – List Category Posts Or Recent Posts: from n/a through 3.3.2.
Product
Posts List Designer by Category – List Category Posts Or Recent Posts
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Posts List Designer by Category – List Category Posts Or Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Profile Builder Pro: Cross-Site Request Forgery (CSRF)CVE-2024-22140 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.
Product
Profile Builder Pro
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update Profile Builder Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder: Cross-Site Request Forgery (CSRF)CVE-2024-22136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder.This issue affects Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder: from n/a through 3.1.5.
Product
Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024FreshMail For: Cross-Site Request Forgery (CSRF)CVE-2024-22304 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2.
Product
FreshMail For
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update FreshMail For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Browser Theme Color: Cross-Site Request Forgery (CSRF)CVE-2024-22291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Browser Theme Color.This issue affects Browser Theme Color: from n/a through 1.3.
Product
Browser Theme Color
Affected
up to 1.3
What to do
Affects up to 1.3. Update Browser Theme Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Frontpage Manager: Cross-Site Request Forgery (CSRF)CVE-2024-22285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Elise Bosse Frontpage Manager.This issue affects Frontpage Manager: from n/a through 1.3.
Product
Frontpage Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Frontpage Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WP Spell Check: Cross-Site Request Forgery (CSRF)CVE-2024-22143 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check.This issue affects WP Spell Check: from n/a through 9.17.
Product
WP Spell Check
Affected
up to 9.17
What to do
Affects up to 9.17. Update WP Spell Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024InstaWP Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-23507 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
Product
InstaWP Connect
Affected
up to 0.1.0.9
What to do
Affects up to 0.1.0.9. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Contact Form builder with drag & drop for WordPress – Kali Forms: Authorization Bypass Through User-Controlled KeyCVE-2024-22305 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36.
Product
Contact Form builder with drag & drop for WordPress – Kali Forms
Affected
up to 2.3.36
What to do
Affects up to 2.3.36. Update Contact Form builder with drag & drop for WordPress – Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Custom Dashboard Widgets: Cross-Site Request Forgery (CSRF)CVE-2024-22290 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting (XSS).This issue affects Custom Dashboard Widgets: from n/a through 1.3.1.
Product
Custom Dashboard Widgets
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Custom Dashboard Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Better Anchor Links: Cross-Site Request Forgery (CSRF)CVE-2024-22287 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links: from n/a through 1.7.5.
Product
Better Anchor Links
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Better Anchor Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WordPress Review & Structure Data Schema Plugin – Review Schema: Unauthorized modification of dataCVE-2024-0836 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrs_review_edit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.
Product
WordPress Review & Structure Data Schema Plugin – Review Schema
Affected
up to 2.1.14
What to do
Affects up to 2.1.14. Update WordPress Review & Structure Data Schema Plugin – Review Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2024Contact Form Entries: Arbitrary file uploadsCVE-2024-1069 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Contact Form Entries
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Contact Form Entries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 30, 2024UserPro: Stored Cross-Site ScriptingCVE-2023-2439 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UserPro
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jan 30, 2024TablePress is a table plugin for Wordpress.CVE-2024-23825 · WordPress plugins & themes · reported by GitHubLow 3
TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by the user. That user input is filtered insufficiently, which makes it is possible to send requests to unintended network locations and receive responses. On sites in a cloud environment like AWS, an attacker can potentially make GET requests to the instance's metadata REST API. If the instance's configuration is insecure, this can lead to the exposure of internal data, including credentials. This vulnerability is fixed in 2.2.5.
Fixed in
2.2.5
What to do
Update the plugin to 2.2.5 or newer.
Full record and what to do →NVD record github.com github.com
Jan 30, 2024the 'id' parameter in the 'get_view' function: The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injectionCVE-2024-1061 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.6
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.
Product
the 'id' parameter in the 'get_view' function
Fixed in
2.5.25
What to do
Update the 'id' parameter in the 'get_view' function to 2.5.25 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Jan 30, 2024MapPress Maps for: Stored Cross-Site ScriptingCVE-2023-7225 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MapPress Maps for
Affected
up to 2.88.16
What to do
Affects up to 2.88.16. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Jan 29, 2024The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which providesCVE-2023-7204 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides
Product
WP STAGING WordPress Backup
Fixed in
3.2.0
What to do
Update WP STAGING WordPress Backup to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024EventON: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-7200 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EventON
Fixed in
4.4.1
What to do
Update EventON to 4.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private postsCVE-2023-7199 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request
Product
Relevanssi
Fixed in
4.22.0
What to do
Update Relevanssi to 4.22.0 or newer.
Full record and what to do →NVD record wpscan.com relevanssi.com
Jan 29, 2024Easy SVG Allow: Does not sanitize uploaded SVG filesCVE-2023-7089 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
Easy SVG Allow
Affected
up to 1.0
What to do
Affects up to 1.0. Update Easy SVG Allow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024WP SOCIAL BOOKMARK MENU: Does not have CSRF check in placeCVE-2023-7074 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
WP SOCIAL BOOKMARK MENU
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP SOCIAL BOOKMARK MENU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 29, 2024Autotitle for: Does not have CSRF check in placeCVE-2023-6946 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autotitle for WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
Autotitle for
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Autotitle for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 29, 2024Site Notes: Does not have CSRF checks in some of its functionalitiesCVE-2023-6633 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks
Product
Site Notes
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Site Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024TJ Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6530 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
TJ Shortcodes
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update TJ Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Jan 29, 2024WP Plugin Lister: Does not have CSRF check in some placesCVE-2023-6503 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Plugin Lister WordPress plugin through 2.1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
WP Plugin Lister
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Plugin Lister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 29, 2024Custom User CSS: Does not have CSRF check in placeCVE-2023-6391 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
Custom User CSS
Affected
up to 0.2
What to do
Affects up to 0.2. Update Custom User CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 29, 2024WordPress Users: Does not have CSRF check in placeCVE-2023-6390 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
WordPress Users
Affected
up to 1.4
What to do
Affects up to 1.4. Update WordPress Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 29, 2024WordPress Toolbar: Redirects to any URL via the "wptbto" parameterCVE-2023-6389 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
WordPress Toolbar
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update WordPress Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 29, 2024Woostify Sites Library: Does not have authorisation in an AJAX actionCVE-2023-6279 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name
Product
Woostify Sites Library
Fixed in
1.4.8
What to do
Update Woostify Sites Library to 1.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the pageCVE-2023-6278 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
Fixed in
2.2.25
What to do
Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to 2.2.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024Restrict Usernames Emails Characters: Does not sanitise and escape some of its settingsCVE-2023-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Restrict Usernames Emails Characters
Fixed in
3.1.4
What to do
Update Restrict Usernames Emails Characters to 3.1.4 or newer.
Full record and what to do →NVD record github.com wpscan.com
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5956 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Wp-Adv-Quiz
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Wp-Adv-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5943 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
Wp-Adv-Quiz
Fixed in
1.0.3
What to do
Update Wp-Adv-Quiz to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024Page Builder: Pagelayer: Doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5124 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
Product
Page Builder: Pagelayer
Fixed in
1.8.0
What to do
Update Page Builder: Pagelayer to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication.CVE-2024-0212 · WordPress plugins & themes · reported by cna@cloudflare.comHigh 8.1
The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.
Fixed in
4.12.3
What to do
Update the plugin to 4.12.3 or newer.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.