Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

422new WordPress flaws this week

399,128entries in the database

41,580 results · page 646 of 832

Dec 19, 2023WordPress Brute Force Protection – Stop Brute Force Attacks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-48764 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GuardGiant Brute Force Protection WordPress Brute Force Protection – Stop Brute Force Attacks.This issue affects WordPress Brute Force Protection – Stop Brute Force Attacks: from n/a through 2.2.5.
Product
WordPress Brute Force Protection – Stop Brute Force Attacks
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WordPress Brute Force Protection – Stop Brute Force Attacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023AI ChatBot: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-48741 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud AI ChatBot.This issue affects AI ChatBot: from n/a through 4.7.8.
Product
AI ChatBot
Affected
up to 4.7.8
What to do
Affects up to 4.7.8. Update AI ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Porto Theme - Functionality: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-48738 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Porto Theme Porto Theme - Functionality.This issue affects Porto Theme - Functionality: from n/a before 2.12.1.
Product
Porto Theme - Functionality
Fixed in
2.12.1
What to do
Update Porto Theme - Functionality to 2.12.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-48327 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Vendors WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors.This issue affects WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors: from n/a through 2.4.7.
Product
WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors
Affected
up to 2.4.7
What to do
Affects up to 2.4.7. Update WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketplace, Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-37982 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Core Web Vitals & PageSpeed Booster: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-35883 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12.
Product
Core Web Vitals & PageSpeed Booster
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Core Web Vitals & PageSpeed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023affiliate-toolkit – WordPress Affiliate: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-45105 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin.This issue affects affiliate-toolkit – WordPress Affiliate Plugin: from n/a through 3.3.9.
Product
affiliate-toolkit – WordPress Affiliate
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update affiliate-toolkit – WordPress Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Login and Logout Redirect: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-41648 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Swapnil V. Patil Login and Logout Redirect.This issue affects Login and Logout Redirect: from n/a through 2.0.3.
Product
Login and Logout Redirect
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Login and Logout Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Doofinder WP & WooCommerce Search: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-40602 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49.
Product
Doofinder WP & WooCommerce Search
Affected
up to 1.5.49
What to do
Affects up to 1.5.49. Update Doofinder WP & WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-38481 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: from n/a before 1.3.7.
Product
Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin
Fixed in
1.3.7
What to do
Update Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin to 1.3.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Integration for WooCommerce and QuickBooks: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-38478 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for WooCommerce and QuickBooks: from n/a through 1.2.3.
Product
Integration for WooCommerce and QuickBooks
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Integration for WooCommerce and QuickBooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Deserialization of Untrusted DataCVE-2023-34382 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.
Product
Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Affected
up to 3.7.19
What to do
Affects up to 3.7.19. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Recently Viewed Products: Deserialization of Untrusted DataCVE-2023-34027 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0.
Product
Recently Viewed Products
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Recently Viewed Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Media File Renamer: Rename Files (Manual, Auto & AI): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects Media File Renamer: Rename Files (Manual, Auto & AI): from n/a through 5.6.9.
Product
Media File Renamer: Rename Files (Manual, Auto & AI)
Affected
up to 5.6.9
What to do
Affects up to 5.6.9. Update Media File Renamer: Rename Files (Manual, Auto & AI) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Aruba HiSpeed Cache: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44983 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.6.
Product
Aruba HiSpeed Cache
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Aruba HiSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Themesflat Addons For Elementor: Deserialization of Untrusted DataCVE-2023-37390 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.
Product
Themesflat Addons For Elementor
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in: Missing AuthorizationCVE-2023-25715 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress: from n/a through 2.5.6.
Product
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Simple Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.This issue affects Simple Membership: from n/a through 4.3.8.
Product
Simple Membership
Affected
up to 4.3.8
What to do
Affects up to 4.3.8. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Jquery news ticker: Stored Cross-Site ScriptingCVE-2023-5432 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jquery news ticker
Affected
up to 3.1
What to do
Affects up to 3.1. Update Jquery news ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2023Image horizontal reel scroll slideshow: Stored Cross-Site ScriptingCVE-2023-5413 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, and including, 13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image horizontal reel scroll slideshow
Affected
up to 13.3
What to do
Affects up to 13.3. Update Image horizontal reel scroll slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2023WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2023-6488 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versions up to, and including, 7.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Affected
up to 7.0.0
What to do
Affects up to 7.0.0. Update WP Shortcodes Plugin — Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2023Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44982 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.
Product
Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)
Affected
up to 6.4.5
What to do
Affects up to 6.4.5. Update Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Structured Content (JSON-LD) #wpsc: Deserialization of Untrusted DataCVE-2023-49819 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.
Product
Structured Content (JSON-LD) #wpsc
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Structured Content (JSON-LD) #wpsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Participants Database: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-48751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5.
Product
Participants Database
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Delete Duplicate Posts: Missing AuthorizationCVE-2023-47754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Clever plugins Delete Duplicate Posts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Delete Duplicate Posts: from n/a through 4.8.9.
Product
Delete Duplicate Posts
Affected
up to 4.8.9
What to do
Affects up to 4.8.9. Update Delete Duplicate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023WP EXtra: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-46212 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a through 6.2.
Product
WP EXtra
Affected
up to 6.2
What to do
Affects up to 6.2. Update WP EXtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023E2Pdf – Export To Pdf Tool for: Deserialization of Untrusted DataCVE-2023-46154 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18.
Product
E2Pdf – Export To Pdf Tool for
Affected
up to 1.20.18
What to do
Affects up to 1.20.18. Update E2Pdf – Export To Pdf Tool for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Thumbs Rating: Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2022-45809 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.0.0.
Product
Thumbs Rating
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Thumbs Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023LiveChat – WP live chat plugin for: Cross-Site Request Forgery (CSRF)CVE-2023-49821 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15.
Product
LiveChat – WP live chat plugin for
Affected
up to 4.5.15
What to do
Affects up to 4.5.15. Update LiveChat – WP live chat plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023CSprite: Cross-Site Request Forgery (CSRF)CVE-2023-49763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Creatomatic Ltd CSprite.This issue affects CSprite: from n/a through 1.1.
Product
CSprite
Affected
up to 1.1
What to do
Affects up to 1.1. Update CSprite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Product Enquiry for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49761 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Gravity Master Product Enquiry for WooCommerce.This issue affects Product Enquiry for WooCommerce: from n/a through 3.0.
Product
Product Enquiry for WooCommerce
Affected
up to 3.0
What to do
Affects up to 3.0. Update Product Enquiry for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023WPsoonOnlinePage: Cross-Site Request Forgery (CSRF)CVE-2023-49760 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Giannopoulos Kostas WPsoonOnlinePage.This issue affects WPsoonOnlinePage: from n/a through 1.9.
Product
WPsoonOnlinePage
Affected
up to 1.9
What to do
Affects up to 1.9. Update WPsoonOnlinePage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023WooDiscuz – WooCommerce Comments: Cross-Site Request Forgery (CSRF)CVE-2023-49759 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.3.0.
Product
WooDiscuz – WooCommerce Comments
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WooDiscuz – WooCommerce Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023teachPress: Cross-Site Request Forgery (CSRF)CVE-2023-49163 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.5.
Product
teachPress
Affected
up to 9.0.5
What to do
Affects up to 9.0.5. Update teachPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Button Generator – easily Button Builder: Cross-Site Request Forgery (CSRF)CVE-2023-49155 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8.
Product
Button Generator – easily Button Builder
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Button Generator – easily Button Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Add to Cart Text Changer and Customize Button, Add Custom Icon: Cross-Site Request Forgery (CSRF)CVE-2023-49153 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart Text Changer and Customize Button, Add Custom Icon: from n/a through 2.0.
Product
Add to Cart Text Changer and Customize Button, Add Custom Icon
Affected
up to 2.0
What to do
Affects up to 2.0. Update Add to Cart Text Changer and Customize Button, Add Custom Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Who Hit The Page – Hit Counter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47558 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mahlamusa Who Hit The Page – Hit Counter allows SQL Injection.This issue affects Who Hit The Page – Hit Counter: from n/a through 1.4.14.3.
Product
Who Hit The Page – Hit Counter
Affected
up to 1.4.14.3
What to do
Affects up to 1.4.14.3. Update Who Hit The Page – Hit Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Redirect 404 Error Page to Homepage or Custom Page with Logs: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47530 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7.
Product
Redirect 404 Error Page to Homepage or Custom Page with Logs
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update Redirect 404 Error Page to Homepage or Custom Page with Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Master Slider Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47506 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Master Slider Pro allows SQL Injection.This issue affects Master Slider Pro: from n/a through 3.6.5.
Product
Master Slider Pro
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update Master Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023WP Report Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-34168 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Raven WP Report Post allows SQL Injection.This issue affects WP Report Post: from n/a through 2.1.2.
Product
WP Report Post
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update WP Report Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Product Vendors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33331 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.
Product
Product Vendors
Affected
up to 2.1.76
What to do
Affects up to 2.1.76. Update Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: Cross-Site Request Forgery (CSRF)CVE-2023-49148 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: from n/a through 3.0.5.
Product
Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023MkRapel Regiones y Ciudades de Chile para WC: Cross-Site Request Forgery (CSRF)CVE-2023-48781 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades de Chile para WC: from n/a through 4.3.0.
Product
MkRapel Regiones y Ciudades de Chile para WC
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update MkRapel Regiones y Ciudades de Chile para WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Product Size Chart For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-48778 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/a through 1.1.5.
Product
Product Size Chart For WooCommerce
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Product Size Chart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023WooCommerce Login Redirect: Cross-Site Request Forgery (CSRF)CVE-2023-48773 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4.
Product
WooCommerce Login Redirect
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update WooCommerce Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Prevent Landscape Rotation: Cross-Site Request Forgery (CSRF)CVE-2023-48772 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0.
Product
Prevent Landscape Rotation
Affected
up to 2.0
What to do
Affects up to 2.0. Update Prevent Landscape Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: Cross-Site Request Forgery (CSRF)CVE-2023-48769 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3.
Product
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
Affected
up to 2.3
What to do
Affects up to 2.3. Update Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Quantity Plus Minus Button for WooCommerce by CodeAstrology: Cross-Site Request Forgery (CSRF)CVE-2023-48768 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology.This issue affects Quantity Plus Minus Button for WooCommerce by CodeAstrology: from n/a through 1.1.9.
Product
Quantity Plus Minus Button for WooCommerce by CodeAstrology
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Quantity Plus Minus Button for WooCommerce by CodeAstrology to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023SiteOrigin Widgets Bundle: Does not validate user input before using it to generate paths passed to include function/sCVE-2023-6295 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
Product
SiteOrigin Widgets Bundle
Fixed in
1.51.0
What to do
Update SiteOrigin Widgets Bundle to 1.51.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Swift Performance Lite: Does not prevent users from exporting the plugin's settingsCVE-2023-6289 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
Product
Swift Performance Lite
Fixed in
2.3.6.15
What to do
Update Swift Performance Lite to 2.3.6.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.