Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

641 results · page 7 of 13

Feb 16, 2025what3words Address Field: Cross-Site Request Forgery (CSRF)CVE-2025-26768 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in what3words what3words Address Field 3-word-address-validation-field allows Stored XSS.This issue affects what3words Address Field: from n/a through <= 4.0.15.
Product
what3words Address Field
Affected
up to 4.0.15
What to do
Affects up to 4.0.15. Update what3words Address Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function.CVE-2024-13791 · WordPress plugins & themes · reported by WordfenceMedium 4.9
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 13, 2025Google Drive WP Media: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moch Amir Google Drive WP Media google-drive-wp-media allows Stored XSS.This issue affects Google Drive WP Media: from n/a through <= 2.4.4.
Product
Google Drive WP Media
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Google Drive WP Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 6, 2025Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: Path TraversalCVE-2025-0859 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.27.6 via the template_via_url() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
Affected
up to 1.27.6
What to do
Affects up to 1.27.6. Update Post and Page Builder by BoldGrid – Visual Drag and Drop Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 4, 2025WP Dream Carousel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WP Dream Carousel
Affected
up to 1.0.1b
What to do
Affects up to 1.0.1b. Update WP Dream Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 4, 2025Solidres: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13329 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Solidres
Affected
up to 0.9.4
What to do
Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 31, 2025Drag and Drop Multiple File Upload – Contact Form 7: Limited arbitrary file deletionCVE-2024-12267 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited arbitrary file deletion due to insufficient file path validation in the dnd_codedropz_upload_delete() function in all versions up to, and including, 1.3.8.5. This makes it possible for unauthenticated attackers to delete limited arbitrary files on the server. It is not possible to delete files like wp-config.php that would make RCE possible.
Product
Drag and Drop Multiple File Upload – Contact Form 7
Affected
up to 1.3.8.5
What to do
Affects up to 1.3.8.5. Update Drag and Drop Multiple File Upload – Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2025Solidres – Hotel booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23911 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in solidres Solidres – Hotel booking plugin solidres allows SQL Injection.This issue affects Solidres – Hotel booking plugin: from n/a through <= 0.9.4.
Product
Solidres – Hotel booking
Affected
up to 0.9.4
What to do
Affects up to 0.9.4. Update Solidres – Hotel booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025DF Draggable: Cross-Site Request Forgery (CSRF)CVE-2025-23708 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Dominic Fallows DF Draggable df-draggable allows Stored XSS.This issue affects DF Draggable: from n/a through <= 1.13.2.
Product
DF Draggable
Affected
up to 1.13.2
What to do
Affects up to 1.13.2. Update DF Draggable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025GDReseller: Cross-Site Request Forgery (CSRF)CVE-2025-23567 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Tamer Ziady GDReseller gdreseller allows Stored XSS.This issue affects GDReseller: from n/a through <= 1.6.
Product
GDReseller
Affected
up to 1.6
What to do
Affects up to 1.6. Update GDReseller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025EditionGuard for WooCommerce – eBook Sales with DRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23452 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Reflected XSS.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.
Product
EditionGuard for WooCommerce – eBook Sales with DRM
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update EditionGuard for WooCommerce – eBook Sales with DRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025UpdraftPlus: WP Backup & Migration: Reflected Cross-Site ScriptingCVE-2025-0215 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Product
UpdraftPlus: WP Backup & Migration
Affected
up to 1.24.12
What to do
Affects up to 1.24.12. Update UpdraftPlus: WP Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 15, 2025PDF for WPForms + Drag and Drop Template Builder: Stored Cross-Site ScriptingCVE-2024-12593 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdf_dotab shortcode in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PDF for WPForms + Drag and Drop Template Builder
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update PDF for WPForms + Drag and Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 11, 2025GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-12877 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server that makes remote code execution possible. Please note this was only partially patched in 3.19.3, a fully sufficient patch was not released until 3.19.4. However, another CVE was assigned by another CNA for version 3.19.3 so we will leave this as affecting 3.19.2 and before. We have recommended the vendor use JSON encoding to prevent any further deserialization vulnerabilities from being present.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.19.2
What to do
Affects up to 3.19.2. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 11, 2025Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently |: Stored Cross-Site ScriptingCVE-2024-12412 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘active_tab’ parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently |
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through <= 2.1.4.
Product
Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025SureForms – Drag and Drop Form Builder for: Information ExposureCVE-2024-12713 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data from password protected, private, or draft posts that they should not have access to.
Product
SureForms – Drag and Drop Form Builder for
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025Multiple Shipping And Billing Address For Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-56290 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows SQL Injection.This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through <= 1.2.
Product
Multiple Shipping And Billing Address For Woocommerce
Affected
up to 1.2
What to do
Affects up to 1.2. Update Multiple Shipping And Billing Address For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket: Reflected Cross-Site ScriptingCVE-2024-12438 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start_date’ and 'end_date' parameters in all versions up to, and including, 4.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket
Affected
up to 4.75
What to do
Affects up to 4.75. Update WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2025Themes Coder – Create Android & iOS Apps For Your Woocommerce Site: Privilege escalationCVE-2024-12402 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's identity prior to updating their password through the update_user_profile() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
Themes Coder – Create Android & iOS Apps For Your Woocommerce Site
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Themes Coder – Create Android & iOS Apps For Your Woocommerce Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 4, 2025UpdraftPlus: WP Backup & Migration: PHP Object InjectionCVE-2024-10957 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit.
Product
UpdraftPlus: WP Backup & Migration
What to do
Update UpdraftPlus: WP Backup & Migration to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025GS Shots for Dribbble: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56263 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Shots for Dribbble gs-dribbble-portfolio allows DOM-Based XSS.This issue affects GS Shots for Dribbble: from n/a through <= 1.2.0.
Product
GS Shots for Dribbble
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update GS Shots for Dribbble to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Email Address Encoder: Cross-Site Request Forgery (CSRF)CVE-2024-43927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects Email Address Encoder: from n/a through <= 1.0.23.
Product
Email Address Encoder
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Email Address Encoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Dragfy Addons for Elementor: Missing AuthorizationCVE-2023-47661 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dragfy Dragfy Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dragfy Addons for Elementor: from n/a through 1.0.2.
Product
Dragfy Addons for Elementor
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Dragfy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Draw Attention: Missing AuthorizationCVE-2023-46616 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in NSquared Draw Attention allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Draw Attention: from n/a through 2.0.15.
Product
Draw Attention
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update Draw Attention to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024EditionGuard for WooCommerce – eBook Sales with DRM: Cross-Site Request Forgery (CSRF)CVE-2024-56207 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Privilege Escalation.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.
Product
EditionGuard for WooCommerce – eBook Sales with DRM
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update EditionGuard for WooCommerce – eBook Sales with DRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Sinking Dropdowns: Cross-Site Request Forgery (CSRF)CVE-2024-56204 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in yonisink Sinking Dropdowns sinking-dropdowns allows Privilege Escalation.This issue affects Sinking Dropdowns: from n/a through <= 1.25.
Product
Sinking Dropdowns
Affected
up to 1.25
What to do
Affects up to 1.25. Update Sinking Dropdowns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Spreadr Woocommerce: Missing AuthorizationCVE-2024-56008 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Spreadr Woocommerce: from n/a through <= 1.0.4.
Product
Spreadr Woocommerce
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Spreadr Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Dr Affiliate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55975 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rohit Urane Dr Affiliate dr-affiliate allows SQL Injection.This issue affects Dr Affiliate: from n/a through <= 1.2.3.
Product
Dr Affiliate
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Dr Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Spreadr Woocommerce: Missing AuthorizationCVE-2024-56009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Spreadr Woocommerce: from n/a through <= 1.0.4.
Product
Spreadr Woocommerce
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Spreadr Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Dreamfox Media Payment gateway per Product for Woocommerce: Missing AuthorizationCVE-2024-55996 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dreamfox Media Payment gateway per Product for Woocommerce: from n/a through <= 3.5.6.
Product
Dreamfox Media Payment gateway per Product for Woocommerce
Affected
up to 3.5.6
What to do
Affects up to 3.5.6. Update Dreamfox Media Payment gateway per Product for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Mandrill WP: Cross-Site Request Forgery (CSRF)CVE-2024-54394 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in khubbaib Mandrill WP email-form-under-post allows Stored XSS.This issue affects Mandrill WP: from n/a through <= 1.0.5.
Product
Mandrill WP
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Mandrill WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 14, 2024GeoDataSource Country Region DropDown: Stored Cross-Site ScriptingCVE-2024-12474 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDataSource Country Region DropDown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gds-country-dropdown' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GeoDataSource Country Region DropDown
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update GeoDataSource Country Region DropDown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-10646 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form's subject parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2024ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: Missing AuthorizationCVE-2022-46811 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VillaTheme(villatheme.com) ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 1.0.21.
Product
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
Affected
up to 1.0.21
What to do
Affects up to 1.0.21. Update ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024The WPMobile.App — Android and iOS Mobile Application: Arbitrary shortcode executionCVE-2024-12420 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The WPMobile.App — Android and iOS Mobile Application
Affected
up to 11.52
What to do
Affects up to 11.52. Update The WPMobile.App — Android and iOS Mobile Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Stored Cross-Site ScriptingCVE-2024-12042 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload HTML files with arbitrary web scripts that will execute whenever a user accesses the file.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.16.4
What to do
Affects up to 4.16.4. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Hash Form – Drag & Drop Form Builder: Unauthorized accessCVE-2024-12201 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.
Product
Hash Form – Drag & Drop Form Builder
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Hash Form – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Drag & Drop Builder fieldsCVE-2024-10517 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.15.15
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.15 or newer.
Full record and what to do →NVD record wpscan.com
Dec 9, 2024Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: Missing AuthorizationCVE-2023-49848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Marc dooder Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy woo-aliexpress-dropshipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy: from n/a through <= 2.1.1.
Product
Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Importify (Dropshipping WooCommerce): Insertion of Sensitive Information Into Debugging CodeCVE-2023-49194 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Debugging Code vulnerability in importify Importify (Dropshipping WooCommerce) importify allows Retrieve Embedded Sensitive Data.This issue affects Importify (Dropshipping WooCommerce): from n/a through <= 1.0.4.
Product
Importify (Dropshipping WooCommerce)
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Importify (Dropshipping WooCommerce) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Mini Cart Drawer For WooCommerce: Missing AuthorizationCVE-2023-47694 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in appsbd Mini Cart Drawer For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mini Cart Drawer For WooCommerce: from n/a through 4.0.0.
Product
Mini Cart Drawer For WooCommerce
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Mini Cart Drawer For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Integrate Google Drive: Missing AuthorizationCVE-2023-32117 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99.
Product
Integrate Google Drive
Affected
up to 1.1.99
What to do
Affects up to 1.1.99. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Sharkdropship for AliExpress Dropship and Affiliate: Missing AuthorizationCVE-2023-30870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship and Affiliate: from n/a through 2.2.3.
Product
Sharkdropship for AliExpress Dropship and Affiliate
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Sharkdropship for AliExpress Dropship and Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Reflected Cross-Site ScriptingCVE-2024-11436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
Affected
up to 1.4.19
What to do
Affects up to 1.4.19. Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 4, 2024Email Address Obfuscation: Stored Cross-Site ScriptingCVE-2024-11935 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Email Address Obfuscation
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Email Address Obfuscation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 3, 2024Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: PHP Object InjectionCVE-2024-10587 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.5.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
Affected
up to 3.7.5.1
What to do
Affects up to 3.7.5.1. Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 23, 2024HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents: Stored Cross-Site ScriptingCVE-2024-11332 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hipaatizer' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 20, 2024MStore API – Create Native Android & iOS Apps On The Cloud: SQL InjectionCVE-2024-11179 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.15.7
What to do
Affects up to 4.15.7. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2024drop in image slideshow gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51914 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus drop in image slideshow gallery drop-in-image-slideshow-gallery allows DOM-Based XSS.This issue affects drop in image slideshow gallery: from n/a through <= 12.0.
Product
drop in image slideshow gallery
Affected
up to 12.0
What to do
Affects up to 12.0. Update drop in image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.