Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
630 results · page 7 of 13
Dec 16, 2024KH Easy User Settings: Incorrect Privilege AssignmentCVE-2024-54365 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Knowhalim KH Easy User Settings kh-easy-user-settings allows Privilege Escalation.This issue affects KH Easy User Settings: from n/a through <= 1.0.0.
- Product
- KH Easy User Settings
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update KH Easy User Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 14, 2024bodi0`s Easy cache: Stored Cross-Site ScriptingCVE-2024-12628 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The bodi0`s Easy cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cache-folder' parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- bodi0`s Easy cache
- Affected
- up to 0.8
- What to do
- Affects up to 0.8. Update bodi0`s Easy cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orggetastra.com
Dec 13, 2024Easy Blocks pro: Missing AuthorizationCVE-2024-54256 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Seerox Easy Blocks pro easy-blocks-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Easy Blocks pro: from n/a through <= 1.0.21.
- Product
- Easy Blocks pro
- Affected
- up to 1.0.21
- What to do
- Affects up to 1.0.21. Update Easy Blocks pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54244 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Easy Replace easy-replace allows Stored XSS.This issue affects Easy Replace: from n/a through <= 1.3.
- Product
- Easy Replace
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Easy Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Newsletter Signups: Missing AuthorizationCVE-2023-41664 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AlphaBPO Easy Newsletter Signups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Newsletter Signups: from n/a through 1.0.4.
- Product
- Easy Newsletter Signups
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Easy Newsletter Signups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Digital Downloads: Missing AuthorizationCVE-2023-40005 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through <= 3.1.5.
- Product
- Easy Digital Downloads
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Donations Made Easy – Smart Donations: Missing AuthorizationCVE-2023-38475 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RedNao Donations Made Easy – Smart Donations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
- Product
- Donations Made Easy – Smart Donations
- Affected
- up to 4.0.12
- What to do
- Affects up to 4.0.12. Update Donations Made Easy – Smart Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easyship WooCommerce Shipping Rates: Missing AuthorizationCVE-2023-37989 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Easyship Easyship WooCommerce Shipping Rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easyship WooCommerce Shipping Rates: from n/a through 0.9.0.
- Product
- Easyship WooCommerce Shipping Rates
- Affected
- up to 0.9.0
- What to do
- Affects up to 0.9.0. Update Easyship WooCommerce Shipping Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Social Icons: Missing AuthorizationCVE-2023-33998 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cybernetikz Easy Social Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Icons: from n/a through 3.2.5.
- Product
- Easy Social Icons
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Easy Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Easy Captcha: Missing AuthorizationCVE-2023-33324 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wppal Easy Captcha allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Captcha: from n/a through 1.0.
- Product
- Easy Captcha
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024Analytics Cat – Google Analytics Made Easy: Reflected Cross-Site ScriptingCVE-2024-12072 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Analytics Cat – Google Analytics Made Easy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link. CVE-2025-24615 is likely a duplicate of this.
- Product
- Analytics Cat – Google Analytics Made Easy
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Analytics Cat – Google Analytics Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 10, 2024iChart – Easy Charts and Graphs: Stored Cross-Site ScriptingCVE-2024-11928 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The iChart – Easy Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- iChart – Easy Charts and Graphs
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update iChart – Easy Charts and Graphs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2024Easy Social Feed: Missing AuthorizationCVE-2023-48740 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sajid Javed Easy Social Feed easy-facebook-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Feed: from n/a through <= 6.5.1.
- Product
- Easy Social Feed
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update Easy Social Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024EasyAzon: Missing AuthorizationCVE-2023-47780 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flowdee EasyAzon easyazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyAzon: from n/a through <= 5.1.0.
- Product
- EasyAzon
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update EasyAzon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-30748 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikola Loncar Easy Appointments allows Stored XSS.This issue affects Easy Appointments: from n/a through 3.10.7.
- Product
- Easy Appointments
- Affected
- up to 3.10.7
- What to do
- Affects up to 3.10.7. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Table of Contents: Missing AuthorizationCVE-2023-25469 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Magazine3 Easy Table of Contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Table of Contents: from n/a through 2.0.45.2.
- Product
- Easy Table of Contents
- Affected
- up to 2.0.45.2
- What to do
- Affects up to 2.0.45.2. Update Easy Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Google Analytics for: Missing AuthorizationCVE-2023-23887 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shaon Easy Google Analytics for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Google Analytics for WordPress: from n/a through 1.6.0.
- Product
- Easy Google Analytics for
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Easy Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 7, 2024Easy Code Snippets: Reflected Cross-Site ScriptingCVE-2024-11464 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Code Snippets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Easy Code Snippets
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Easy Code Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 2, 2024eDoc Easy Tables: Cross-Site Request Forgery (CSRF)CVE-2024-53793 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows Blind SQL Injection.This issue affects eDoc Easy Tables: from n/a through <= 1.29.
- Product
- eDoc Easy Tables
- Affected
- up to 1.29
- What to do
- Affects up to 1.29. Update eDoc Easy Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024`Kudos Donations – Easy donations and payments with Mollie`: Reflected Cross-Site ScriptingCVE-2024-11685 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The `Kudos Donations – Easy donations and payments with Mollie` plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of `add_query_arg` without appropriate escaping on the URL in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link.
- Product
- `Kudos Donations – Easy donations and payments with Mollie`
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update `Kudos Donations – Easy donations and payments with Mollie` to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 28, 2024Kudos Donations – Easy donations and payments with Mollie: Reflected Cross-Site ScriptingCVE-2024-11684 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Kudos Donations – Easy donations and payments with Mollie plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Kudos Donations – Easy donations and payments with Mollie
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Kudos Donations – Easy donations and payments with Mollie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 23, 2024Easy Liveblogs: Stored Cross-Site ScriptingCVE-2024-11387 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Liveblogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elb_liveblog' shortcode in all versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Easy Liveblogs
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Easy Liveblogs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 22, 2024Easy Twitter Feed – Twitter feeds plugin for WP: Information ExposureCVE-2024-10666 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the [etf] shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
- Product
- Easy Twitter Feed – Twitter feeds plugin for WP
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Easy Twitter Feed – Twitter feeds plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 19, 2024Easy Social Sharebar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51833 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nomaniplex Easy Social Sharebar easy-social-sharebar allows Stored XSS.This issue affects Easy Social Sharebar: from n/a through <= 1.0.0.
- Product
- Easy Social Sharebar
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Easy Social Sharebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Easy Accordion Gutenberg Block: Missing AuthorizationCVE-2024-51660 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Binsaifullah Easy Accordion Gutenberg Block easy-accordion-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Accordion Gutenberg Block: from n/a through <= 1.2.3.
- Product
- Easy Accordion Gutenberg Block
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Easy Accordion Gutenberg Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Easy CSV Importer BETA: Unrestricted Upload of File with Dangerous TypeCVE-2024-52372 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in WebTechGlobal Easy CSV Importer BETA easy-csv-importer allows Upload a Web Shell to a Web Server.This issue affects Easy CSV Importer BETA: from n/a through <= 7.0.0.
- Product
- Easy CSV Importer BETA
- Affected
- up to 7.0.0
- What to do
- Affects up to 7.0.0. Update Easy CSV Importer BETA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2024WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: Cross-Site Request ForgeryCVE-2024-10593 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.1.6. This is due to missing or incorrect nonce validation on the process_admin_ui function. This makes it possible for unauthenticated attackers to delete WPForm logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- Affected
- up to 1.9.1.6
- What to do
- Affects up to 1.9.1.6. Update WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 9, 2024WP EASY RECIPE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51622 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-EXPERTS.IN WP EASY RECIPE wp-easy-recipe allows Stored XSS.This issue affects WP EASY RECIPE: from n/a through <= 1.6.
- Product
- WP EASY RECIPE
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update WP EASY RECIPE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Easy Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51570 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in odihost Easy Gallery simple-gallery-odihost allows SQL Injection.This issue affects Easy Gallery: from n/a through <= 1.4.
- Product
- Easy Gallery
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Easy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2024Easy SVG Support: Stored Cross-Site ScriptingCVE-2024-10269 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Easy SVG Support
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Easy SVG Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 6, 2024Pricing Tables WordPress Plugin – Easy Pricing Tables: Stored Cross-Site ScriptingCVE-2024-8323 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFamily’ attribute in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Pricing Tables WordPress Plugin – Easy Pricing Tables
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Pricing Tables WordPress Plugin – Easy Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2024Easy Digital Downloads: Missing AuthorizationCVE-2024-43162 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.2.12.
- Product
- Easy Digital Downloads
- Affected
- up to 3.2.12
- What to do
- Affects up to 3.2.12. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Easy SVG Upload: Stored Cross-Site ScriptingCVE-2024-9708 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy SVG Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Easy SVG Upload
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Easy SVG Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 30, 2024Pricing Tables WordPress Plugin – Easy Pricing Tables: Reflected Cross-Site ScriptingCVE-2024-8871 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Pricing Tables WordPress Plugin – Easy Pricing Tables
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Pricing Tables WordPress Plugin – Easy Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2024Easy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abdul Kader Easy Addons for Elementor easy-addons-for-elementor allows Stored XSS.This issue affects Easy Addons for Elementor: from n/a through <= 1.5.0.
- Product
- Easy Addons for Elementor
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Easy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024WP Easy Post Types: Stored Cross-Site ScriptingCVE-2024-10080 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Easy Post Types
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update WP Easy Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 18, 2024WP Easy Post Types: PHP Object InjectionCVE-2024-10079 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajax_import_content' function. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- WP Easy Post Types
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update WP Easy Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 18, 2024WP Easy Post Types: Unauthorized access, modification, and loss of dataCVE-2024-10078 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.
- Product
- WP Easy Post Types
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update WP Easy Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 18, 2024Easy Menu Manager | WPZest: Stored Cross-Site ScriptingCVE-2024-9366 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Easy Menu Manager | WPZest
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Easy Menu Manager | WPZest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 17, 2024EasyJobs: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43997 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in easy.Jobs EasyJobs allows Reflected XSS.This issue affects EasyJobs: from n/a through 2.4.14.
- Product
- EasyJobs
- Affected
- up to 2.4.14
- What to do
- Affects up to 2.4.14. Update EasyJobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2024TablePress – Tables in WordPress made easy: Stored Cross-Site ScriptingCVE-2024-9595 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TablePress – Tables in WordPress made easy
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update TablePress – Tables in WordPress made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 11, 2024Easy PayPal Gift Certificate: Cross-Site Request ForgeryCVE-2024-9592 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy PayPal Gift Certificate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the 'wpppgc_plugin_options' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Easy PayPal Gift Certificate
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Easy PayPal Gift Certificate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 9, 2024Easy Social Share Buttons: Reflected Cross-Site ScriptingCVE-2024-8729 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Easy Social Share Buttons
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Easy Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 8, 2024Easy Mega Menu Plugin for WordPress – ThemeHunk: Stored Cross-Site ScriptingCVE-2024-8433 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that this was partially fixed in 1.1.0 due to the missing authorization protection that was added.
- Product
- Easy Mega Menu Plugin for WordPress – ThemeHunk
- Affected
- up to 1.1.0
- Fixed in
- 1.1.0
- What to do
- Update Easy Mega Menu Plugin for WordPress – ThemeHunk to 1.1.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 4, 2024Easy Demo Importer – A Modern One-Click Demo Import Solution: Stored Cross-Site ScriptingCVE-2024-9071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Easy Demo Importer – A Modern One-Click Demo Import Solution
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Easy Demo Importer – A Modern One-Click Demo Import Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 2, 2024PWA — easy way to Progressive Web App: Stored Cross-Site ScriptingCVE-2024-8967 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- PWA — easy way to Progressive Web App
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update PWA — easy way to Progressive Web App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2024WP Easy Gallery – WordPress Gallery: Time-based SQL InjectionCVE-2024-9018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Easy Gallery – WordPress Gallery
- Affected
- up to 4.8.5
- What to do
- Affects up to 4.8.5. Update WP Easy Gallery – WordPress Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 1, 2024Easy WordPress Subscribe – Optin Hound: Reflected Cross-Site ScriptingCVE-2024-9267 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy WordPress Subscribe – Optin Hound plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Easy WordPress Subscribe – Optin Hound
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Easy WordPress Subscribe – Optin Hound to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 1, 2024Easy Load More: Reflected Cross-Site ScriptingCVE-2024-8728 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Easy Load More
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Easy Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 24, 2024Easy PayPal Events: Cross-Site Request ForgeryCVE-2024-8476 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeevent_plugin_buttons() function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Easy PayPal Events
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Easy PayPal Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.