Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

422new WordPress flaws this week

399,128entries in the database

41,580 results · page 645 of 832

Dec 20, 2023WordPress Job Board and Recruitment Plugin – JobWP: Unrestricted Upload of File with Dangerous TypeCVE-2023-29384 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.
Product
WordPress Job Board and Recruitment Plugin – JobWP
Affected
up to 2.0
What to do
Affects up to 2.0. Update WordPress Job Board and Recruitment Plugin – JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Olive One Click Demo Import: Unrestricted Upload of File with Dangerous TypeCVE-2023-29102 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.
Product
Olive One Click Demo Import
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Olive One Click Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Theme Demo Import: Unrestricted Upload of File with Dangerous TypeCVE-2023-28170 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1.
Product
Theme Demo Import
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Theme Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Adifier - Classified Ads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49752 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads WordPress Theme.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
Product
Adifier - Classified Ads
Fixed in
3.1.4
What to do
Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023MSync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49166 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0.
Product
MSync
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update MSync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Bravo Translate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49161 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Guelben Bravo Translate.This issue affects Bravo Translate: from n/a through 1.2.
Product
Bravo Translate
Affected
up to 1.2
What to do
Affects up to 1.2. Update Bravo Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Houzez - Real Estate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-29432 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.
Product
Houzez - Real Estate
Fixed in
2.8.3
What to do
Update Houzez - Real Estate to 2.8.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Contact Form to DB by BestWebSoft – Messages Database Plugin For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-29096 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.0.
Product
Contact Form to DB by BestWebSoft – Messages Database Plugin For
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Advanced Page Visit Counter – Most Wanted Analytics Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28788 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 6.4.2.
Product
Advanced Page Visit Counter – Most Wanted Analytics Plugin for
Affected
up to 6.4.2
What to do
Affects up to 6.4.2. Update Advanced Page Visit Counter – Most Wanted Analytics Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Slideshow Gallery LITE: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28491 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6.
Product
Slideshow Gallery LITE
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Slideshow Gallery LITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-26525 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.12.
Product
Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Affected
up to 3.7.12
What to do
Affects up to 3.7.12. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: Deserialization of Untrusted DataCVE-2022-47599 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.
Product
File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager
Affected
up to 5.2.7
What to do
Affects up to 5.2.7. Update File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Popup Maker – Popup for opt-ins, lead gen, & more: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-47597 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1.
Product
Popup Maker – Popup for opt-ins, lead gen, & more
Affected
up to 1.17.1
What to do
Affects up to 1.17.1. Update Popup Maker – Popup for opt-ins, lead gen, & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023BSK Forms Blacklist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30872 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Forms Blacklist: from n/a through 3.6.2.
Product
BSK Forms Blacklist
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023CM Popup Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30750 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This issue affects CM Popup Plugin for WordPress: from n/a through 1.5.10.
Product
CM Popup Plugin for
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update CM Popup Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Ultimate Addons for Contact Form 7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30495 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.
Product
Ultimate Addons for Contact Form 7
Affected
up to 3.1.23
What to do
Affects up to 3.1.23. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Soledad – Multipurpose, Newspaper, Blog & WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49825 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Product
Soledad – Multipurpose, Newspaper, Blog & WooCommerce
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Soledad – Multipurpose, Newspaper, Blog & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Sayfa Sayac: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49776 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6.
Product
Sayfa Sayac
Affected
up to 2.6
What to do
Affects up to 2.6. Update Sayfa Sayac to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023BCorp Shortcodes: Deserialization of Untrusted DataCVE-2023-49773 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Tim Brattberg BCorp Shortcodes.This issue affects BCorp Shortcodes: from n/a through 0.23.
Product
BCorp Shortcodes
Affected
up to 0.23
What to do
Affects up to 0.23. Update BCorp Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Genesis Simple Love: Deserialization of Untrusted DataCVE-2023-49772 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Phpbits Creative Studio Genesis Simple Love.This issue affects Genesis Simple Love: from n/a through 2.0.
Product
Genesis Simple Love
Affected
up to 2.0
What to do
Affects up to 2.0. Update Genesis Simple Love to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023WooPayments – Fully Integrated Solution Built and Supported by Woo: Authorization Bypass Through User-Controlled KeyCVE-2023-35916 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.
Product
WooPayments – Fully Integrated Solution Built and Supported by Woo
Affected
up to 5.9.0
What to do
Affects up to 5.9.0. Update WooPayments – Fully Integrated Solution Built and Supported by Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023WooPayments – Fully Integrated Solution Built and Supported by Woo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-35915 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.
Product
WooPayments – Fully Integrated Solution Built and Supported by Woo
Affected
up to 5.9.0
What to do
Affects up to 5.9.0. Update WooPayments – Fully Integrated Solution Built and Supported by Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Woo Subscriptions: Authorization Bypass Through User-Controlled KeyCVE-2023-35914 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.
Product
Woo Subscriptions
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update Woo Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023AutomateWoo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33330 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.50.
Product
AutomateWoo
Affected
up to 4.9.50
What to do
Affects up to 4.9.50. Update AutomateWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023SEO Change Monitor – Track Website Changes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33209 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track Website Changes.This issue affects SEO Change Monitor – Track Website Changes: from n/a through 1.2.
Product
SEO Change Monitor – Track Website Changes
Affected
up to 1.2
What to do
Affects up to 1.2. Update SEO Change Monitor – Track Website Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023AutomateWoo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32743 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.1.
Product
AutomateWoo
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update AutomateWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32128 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adastra Crypto Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free.This issue affects Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free: from n/a through 2.2.7.
Product
Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Easy Bet: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-31092 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Foxskav Easy Bet.This issue affects Easy Bet: from n/a through 1.0.2.
Product
Easy Bet
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Easy Bet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47852 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.
Product
Link Whisper Free
Affected
up to 0.6.5
What to do
Affects up to 0.6.5. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023HUSKY – Products Filter for WooCommerce Professional: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-40010 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY – Products Filter for WooCommerce Professional.This issue affects HUSKY – Products Filter for WooCommerce Professional: from n/a through 1.3.4.2.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.3.4.2
What to do
Affects up to 1.3.4.2. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Editorial Calendar: Authorization Bypass Through User-Controlled KeyCVE-2023-36520 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12.
Product
Editorial Calendar
Affected
up to 3.7.12
What to do
Affects up to 3.7.12. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023WooCommerce Square: Authorization Bypass Through User-Controlled KeyCVE-2023-35876 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.
Product
WooCommerce Square
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update WooCommerce Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Subscribe to Category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32590 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category.This issue affects Subscribe to Category: from n/a through 2.7.4.
Product
Subscribe to Category
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update Subscribe to Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Gravity Forms: Deserialization of Untrusted DataCVE-2023-28782 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3.
Product
Gravity Forms
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Master Slider Pro: Deserialization of Untrusted DataCVE-2023-47507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5.
Product
Master Slider Pro
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update Master Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023iPages Flipbook For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47236 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum iPages Flipbook For WordPress.This issue affects iPages Flipbook For WordPress: from n/a through 1.4.8.
Product
iPages Flipbook For
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update iPages Flipbook For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Comments – wpDiscuz: Authorization Bypass Through User-Controlled KeyCVE-2023-46311 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3.
Product
Comments – wpDiscuz
Affected
up to 7.6.3
What to do
Affects up to 7.6.3. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Themify Ultra: Deserialization of Untrusted DataCVE-2023-46147 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Sunshine Photo Cart: Free Client Galleries for Photographers: Authorization Bypass Through User-Controlled KeyCVE-2023-41796 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0.
Product
Sunshine Photo Cart: Free Client Galleries for Photographers
Fixed in
3.0.0
What to do
Update Sunshine Photo Cart: Free Client Galleries for Photographers to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Flatsome | Multi-Purpose Responsive WooCommerce: Deserialization of Untrusted DataCVE-2023-40555 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.
Product
Flatsome | Multi-Purpose Responsive WooCommerce
Affected
up to 3.17.5
What to do
Affects up to 3.17.5. Update Flatsome | Multi-Purpose Responsive WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-38519 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance.This issue affects MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: from n/a through 4.4.3.3.
Product
MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Affected
up to 4.4.3.3
What to do
Affects up to 4.4.3.3. Update MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Photo Engine (Media Organizer & Lightroom): Authorization Bypass Through User-Controlled KeyCVE-2023-38513 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom): from n/a through 6.2.5.
Product
Photo Engine (Media Organizer & Lightroom)
Affected
up to 6.2.5
What to do
Affects up to 6.2.5. Update Photo Engine (Media Organizer & Lightroom) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023GoCardless: Authorization Bypass Through User-Controlled KeyCVE-2023-37871 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.
Product
GoCardless
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update GoCardless to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Advanced Category Template: Cross-Site Request Forgery (CSRF)CVE-2023-50835 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Praveen Goswami Advanced Category Template.This issue affects Advanced Category Template: from n/a through 0.1.
Product
Advanced Category Template
Affected
up to 0.1
What to do
Affects up to 0.1. Update Advanced Category Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Ocean Extra: Cross-Site Request Forgery (CSRF)CVE-2023-49164 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2.
Product
Ocean Extra
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Parcel Pro: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-46624 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Parcel Pro.This issue affects Parcel Pro: from n/a through 1.6.11.
Product
Parcel Pro
Affected
up to 1.6.11
What to do
Affects up to 1.6.11. Update Parcel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Stream: Authorization Bypass Through User-Controlled KeyCVE-2022-43450 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2.
Product
Stream
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update Stream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023WP Photo Album Plus: Authorization Bypass Through User-Controlled KeyCVE-2023-49812 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
Product
WP Photo Album Plus
Affected
up to 8.5.02.005
What to do
Affects up to 8.5.02.005. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Advanced Database Cleaner: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49764 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Younes JFR. Advanced Database Cleaner.This issue affects Advanced Database Cleaner: from n/a through 3.1.2.
Product
Advanced Database Cleaner
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Advanced Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Couponis - Affiliate & Submitting Coupons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49750 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoonthemes Couponis - Affiliate & Submitting Coupons WordPress Theme.This issue affects Couponis - Affiliate & Submitting Coupons WordPress Theme: from n/a before 2.2.
Product
Couponis - Affiliate & Submitting Coupons
Fixed in
2.2
What to do
Update Couponis - Affiliate & Submitting Coupons to 2.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.