Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

422new WordPress flaws this week

399,128entries in the database

41,580 results · page 638 of 832

Jan 12, 2024Profile Builder Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22142 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This issue affects Profile Builder Pro: from n/a through 3.10.0.
Product
Profile Builder Pro
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update Profile Builder Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 12, 2024Constant Contact Forms by MailMunch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22137 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch Constant Contact Forms by MailMunch allows Stored XSS.This issue affects Constant Contact Forms by MailMunch: from n/a through 2.0.11.
Product
Constant Contact Forms by MailMunch
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Constant Contact Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 12, 2024WordPress Quiz Maker Plugin prior to 6.5.0.6: Improper input validationCVE-2024-22027 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against external services.
Product
WordPress Quiz Maker Plugin prior to 6.5.0.6
Fixed in
6.5.0.6
What to do
Update WordPress Quiz Maker Plugin prior to 6.5.0.6 to 6.5.0.6 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 11, 2024Oxygen Builder: Stored Cross-Site ScriptingCVE-2023-6938 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Version 4.8.1 of the Oxygen Builder plugin for WordPress addresses this vulnerability by implementing an optional filter to provide output escaping for dynamic data. Please see https://oxygenbuilder.com/documentation/other/security/#filtering-dynamic-data for more details.
Product
Oxygen Builder
Affected
up to 4.8
What to do
Affects up to 4.8. Update Oxygen Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record oxygenbuilder.com wordfence.com
Jan 11, 2024EventON - WordPress Virtual Event Calendar: Cross-Site Request ForgeryCVE-2023-6244 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or incorrect nonce validation on the save_virtual_event_settings function. This makes it possible for unauthenticated attackers to modify virtual event settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
EventON - WordPress Virtual Event Calendar
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update EventON - WordPress Virtual Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.myeventon.com plugins.trac.wordpress.org
Jan 11, 2024EventON - WordPress Virtual Event Calendar: Cross-Site Request ForgeryCVE-2023-6242 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_eventpost_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
EventON - WordPress Virtual Event Calendar
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update EventON - WordPress Virtual Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.myeventon.com plugins.trac.wordpress.org
Jan 11, 2024Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates: Stored Cross-Site ScriptingCVE-2023-7071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Email Encoder – Protect Email Addresses and Phone Numbers: Stored Cross-Site ScriptingCVE-2023-7070 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eeb_mailto shortcode in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Email Encoder – Protect Email Addresses and Phone Numbers
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Email Encoder – Protect Email Addresses and Phone Numbers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024My Sticky Bar: Cross-Site Request ForgeryCVE-2023-7048 · WordPress plugins & themes · reported by WordfenceLow 3.1
The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due to missing or incorrect nonce validation in mystickymenu-contact-leads.php. This makes it possible for unauthenticated attackers to trigger the export of a CSV file containing contact leads via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Because the CSV file is exported to a public location, it can be downloaded during a very short window of time before it is automatically deleted by the export function.
Product
My Sticky Bar
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update My Sticky Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024LightStart – Maintenance Mode, Coming Soon and Landing Page Builder: Unauthorized modification of dataCVE-2023-7019 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to change page designs.
Product
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
Affected
up to 2.6.8
What to do
Affects up to 2.6.8. Update LightStart – Maintenance Mode, Coming Soon and Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024List category posts: Stored Cross-Site ScriptingCVE-2023-6994 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
List category posts
Affected
up to 0.89.3
What to do
Affects up to 0.89.3. Update List category posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jan 11, 2024Weaver Xtreme: Stored Cross-Site ScriptingCVE-2023-6990 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta (page-head-code). This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Weaver Xtreme
Affected
up to 6.3.0
What to do
Affects up to 6.3.0. Update Weaver Xtreme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Jan 11, 2024Colibri Page Builder: Stored Cross-Site ScriptingCVE-2023-6988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortcode in all versions up to, and including, 1.0.239 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Colibri Page Builder
Affected
up to 1.0.239
What to do
Affects up to 1.0.239. Update Colibri Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Customer Reviews for WooCommerce: Arbitrary file uploadsCVE-2023-6979 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to, and including, 5.38.9. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Customer Reviews for WooCommerce
Affected
up to 5.38.9
What to do
Affects up to 5.38.9. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record drive.proton.me plugins.trac.wordpress.org
Jan 11, 2024Limit Login Attempts Reloaded: Stored Cross-Site ScriptingCVE-2023-6934 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Limit Login Attempts Reloaded
Affected
up to 2.25.26
What to do
Affects up to 2.25.26. Update Limit Login Attempts Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Photo Gallery by 10Web: Stored Cross-Site ScriptingCVE-2023-6924 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. It can also be exploited with a contributor-level permission with a page builder plugin.
Product
Photo Gallery by 10Web
Affected
up to 1.8.18
What to do
Affects up to 1.8.18. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Simple Membership: Reflected Cross-Site ScriptingCVE-2023-6882 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versions up to, and including, 4.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Simple Membership
Affected
up to 4.3.8
What to do
Affects up to 4.3.8. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Slick Social Share Buttons: Unauthorized modification of dataCVE-2023-6878 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Slick Social Share Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dcssb_ajax_update' function in versions up to, and including, 2.4.11. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily.
Product
Slick Social Share Buttons
Affected
up to 2.4.11
What to do
Affects up to 2.4.11. Update Slick Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Unauthorized access of data and modification of dataCVE-2023-6875 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to the mailer and view logs, including password reset emails, allowing site takeover. CVE-2023-52233 appears to be a duplicate of this issue.
Product
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Unauthorized modification of membership levels created by the pluginCVE-2023-6855 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmpro_rest_api_get_permissions_check function in all versions up to 2.12.5 (inclusive). This makes it possible for unauthenticated attackers to change membership levels including prices.
Product
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Affected
up to 2.12.5
What to do
Affects up to 2.12.5. Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder: Stored Cross-Site ScriptingCVE-2023-6828 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ arf_http_referrer_url’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024AMP for WP – Accelerated Mobile Pages: Stored Cross-Site ScriptingCVE-2023-6782 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.0.92
What to do
Affects up to 1.0.92. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Orbit Fox by ThemeIsle: Stored Cross-Site ScriptingCVE-2023-6781 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 2.10.26 due to insufficient input sanitization and output escaping on user supplied values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Orbit Fox by ThemeIsle
Affected
up to 2.10.26
What to do
Affects up to 2.10.26. Update Orbit Fox by ThemeIsle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 20243D FlipBook: Stored Cross-Site ScriptingCVE-2023-6776 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Ready Function’ field in all versions up to, and including, 1.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
3D FlipBook
Affected
up to 1.15.2
What to do
Affects up to 1.15.2. Update 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Hostinger: Unauthorized plugin settings updateCVE-2023-6751 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.
Product
Hostinger
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update Hostinger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2023-6742 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'envira_gallery_insert_images' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users' posts.
Product
Gallery Plugin for WordPress – Envira Photo Gallery
Affected
up to 1.8.7.1
What to do
Affects up to 1.8.7.1. Update Gallery Plugin for WordPress – Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Enable Media Replace: Reflected Cross-Site ScriptingCVE-2023-6737 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploiting this vulnerability requires the attacker to know the ID of an attachment uploaded by the user they are attacking.
Product
Enable Media Replace
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Enable Media Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Ibtana – WordPress Website Builder: Stored Cross-Site ScriptingCVE-2023-6684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ive' shortcode in versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on 'width' and 'height' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ibtana – WordPress Website Builder
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Ibtana – WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Post Grid Combo – 36+ Gutenberg Blocks: Stored Cross-Site ScriptingCVE-2023-6645 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid Combo – 36+ Gutenberg Blocks
Affected
up to 2.2.64
What to do
Affects up to 2.2.64. Update Post Grid Combo – 36+ Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024GTG Product Feed for Shopping: Unauthorized modification of dataCVE-2023-6638 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated attackers to update plugin settings.
Product
GTG Product Feed for Shopping
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update GTG Product Feed for Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024CAOS | Host Google Analytics Locally: Unauthorized modification of dataCVE-2023-6637 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CAOS | Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 4.7.14. This makes it possible for unauthenticated attackers to update plugin settings.
Product
CAOS | Host Google Analytics Locally
Affected
up to 4.7.14
What to do
Affects up to 4.7.14. Update CAOS | Host Google Analytics Locally to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Greenshift – animation and page builder blocks: Arbitrary file uploadsCVE-2023-6636 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'gspb_save_files' function in versions up to, and including, 7.6.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Greenshift – animation and page builder blocks
Affected
up to 7.6.2
What to do
Affects up to 7.6.2. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024LearnPress: Command InjectionCVE-2023-6634 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution.
Product
LearnPress
Affected
up to 4.2.5.7
What to do
Affects up to 4.2.5.7. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Happy Addons for Elementor: Reflected Cross-Site ScriptingCVE-2023-6632 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 (versions up to 2.9.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Happy Addons for Elementor
Affected
up to 3.9.1.1
What to do
Affects up to 3.9.1.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Import and export users and customers: Stored Cross-Site ScriptingCVE-2023-6624 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.24.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Import and export users and customers
Affected
up to 1.24.3
What to do
Affects up to 1.24.3. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024SpeedyCache: Unauthorized modification of dataCVE-2023-6598 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache_save_varniship, speedycache_img_update_settings, speedycache_preloading_add_settings, and speedycache_preloading_delete_resource functions in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update plugin options.
Product
SpeedyCache
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update SpeedyCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Import and export users and customers: Directory TraversalCVE-2023-6583 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information.
Product
Import and export users and customers
Affected
up to 1.24.2
What to do
Affects up to 1.24.2. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024ElementsKit Elementor addons: Sensitive Information ExposureCVE-2023-6582 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to obtain contents of posts in draft, private or pending review status that should not be visible to the general public. This applies to posts created with Elementor only.
Product
ElementsKit Elementor addons
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update ElementsKit Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024LearnPress: Time-based SQL InjectionCVE-2023-6567 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LearnPress
Affected
up to 4.2.5.7
What to do
Affects up to 4.2.5.7. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Featured Image from URL (FIFU): Stored Cross-Site ScriptingCVE-2023-6561 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Featured Image from URL (FIFU)
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Featured Image from URL (FIFU) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Export and Import Users and Customers: Arbitrary file uploadsCVE-2023-6558 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'upload_import_file' function in versions up to, and including, 2.4.8. This makes it possible for authenticated attackers with shop manager-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Export and Import Users and Customers
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024FOX – Currency Switcher Professional for WooCommerce: Stored Cross-Site ScriptingCVE-2023-6556 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via currency options in all versions up to, and including, 1.4.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FOX – Currency Switcher Professional for WooCommerce
Affected
up to 1.4.1.5
What to do
Affects up to 1.4.1.5. Update FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Unauthorized access of dataCVE-2023-6504 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.10.7
What to do
Affects up to 3.10.7. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Manage Notification E-mails: Missing AuthorizationCVE-2023-6496 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings.
Product
Manage Notification E-mails
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Manage Notification E-mails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024Export WP Page to Static HTML/CSS: Unauthorized access of data and modification of dataCVE-2023-6369 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose sensitive information or perform unauthorized actions, such as saving advanced plugin settings.
Product
Export WP Page to Static HTML/CSS
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024MW WP Form: Arbitrary file uploadsCVE-2023-6316 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_upload' function in versions up to, and including, 5.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
MW WP Form
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Backup Migration: Unauthorized access of dataCVE-2023-6266 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more.
Product
Backup Migration
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Piotnet Forms: Arbitrary file uploadsCVE-2023-6220 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetforms_ajax_form_builder' function in versions up to, and including, 1.0.28. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Piotnet Forms
Affected
up to 1.0.28
What to do
Affects up to 1.0.28. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Chatbot for: Stored Cross-Site ScriptingCVE-2023-5691 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Chatbot for
Affected
up to 2.3.9
What to do
Affects up to 2.3.9. Update Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2024BackWPup: Directory TraversalCVE-2023-5504 · WordPress plugins & themes · reported by WordfenceHigh 8.7
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.
Product
BackWPup
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update BackWPup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.