Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

1,479 results · page 7 of 30

Jan 7, 2025News Publisher Autopilot: Cross-Site Request Forgery (CSRF)CVE-2025-22557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in cdowp News Publisher Autopilot wpm-news-api allows Cross Site Request Forgery.This issue affects News Publisher Autopilot: from n/a through <= 2.1.4.
Product
News Publisher Autopilot
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update News Publisher Autopilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Trendy News: Cross-Site Request Forgery (CSRF)CVE-2024-37473 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blazethemes Trendy News trendy-news allows Cross Site Request Forgery.This issue affects Trendy News: from n/a through <= 1.0.15.
Product
Trendy News
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Trendy News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025NewsMash: Cross-Site Request Forgery (CSRF)CVE-2024-37441 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in desertthemes NewsMash newsmash allows Cross Site Request Forgery.This issue affects NewsMash: from n/a through <= 1.0.34.
Product
NewsMash
Affected
up to 1.0.34
What to do
Affects up to 1.0.34. Update NewsMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Newspack Newsletters: Cross-Site Request Forgery (CSRF)CVE-2024-37242 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Cross Site Request Forgery.This issue affects Newspack Newsletters: from n/a through <= 2.13.2.
Product
Newspack Newsletters
Affected
up to 2.13.2
What to do
Affects up to 2.13.2. Update Newspack Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Flash News / Post (Responsive): Cross-Site Request Forgery (CSRF)CVE-2024-56012 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Flash News / Post (Responsive) flashnews-fading-effect-pearlbells allows Privilege Escalation.This issue affects Flash News / Post (Responsive): from n/a through <= 4.1.
Product
Flash News / Post (Responsive)
Affected
up to 4.1
What to do
Affects up to 4.1. Update Flash News / Post (Responsive) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024EELV Newsletter: Cross-Site Request Forgery (CSRF)CVE-2024-54430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Cross Site Request Forgery.This issue affects EELV Newsletter: from n/a through <= 4.8.2.
Product
EELV Newsletter
Affected
up to 4.8.2
What to do
Affects up to 4.8.2. Update EELV Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024News Ticker for Elementor: Missing AuthorizationCVE-2024-54278 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through <= 2.1.3.
Product
News Ticker for Elementor
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update News Ticker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Easy Newsletter Signups: Missing AuthorizationCVE-2023-41664 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AlphaBPO Easy Newsletter Signups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Newsletter Signups: from n/a through 1.0.4.
Product
Easy Newsletter Signups
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Easy Newsletter Signups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024NewsmanApp: Stored Cross-Site ScriptingCVE-2024-11767 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'newsman_subscribe_widget' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
NewsmanApp
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update NewsmanApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024Newsletter Subscriptions: Reflected Cross-Site ScriptingCVE-2024-11683 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Newsletter Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_type' parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Newsletter Subscriptions
Affected
up to 2.1
What to do
Affects up to 2.1. Update Newsletter Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2024News Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54260 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
Product
News Kit Elementor Addons
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024BlossomThemes Email Newsletter: Missing AuthorizationCVE-2023-47849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Blossom Themes BlossomThemes Email Newsletter blossomthemes-email-newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through <= 2.2.4.
Product
BlossomThemes Email Newsletter
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update BlossomThemes Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024NewsMash: Stored Cross-Site ScriptingCVE-2024-10849 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NewsMash theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-56208 is a duplicate of this issue.
Product
NewsMash
Affected
up to 1.0.71
What to do
Affects up to 1.0.71. Update NewsMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Dec 6, 2024Pubnews: Unauthorized arbitrary plugin installationCVE-2024-10578 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnews_importer_plugin_action_for_notice() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins that can be leveraged to exploit other vulnerabilities.
Product
Pubnews
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Pubnews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Dec 5, 2024NewsMunch: Stored Cross-Site ScriptingCVE-2024-10848 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The NewsMunch theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
NewsMunch
Affected
up to 1.0.35
What to do
Affects up to 1.0.35. Update NewsMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Dec 2, 2024Smart Marketing SMS and Newsletters Forms: Missing AuthorizationCVE-2024-53784 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in E-goi Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Marketing SMS and Newsletters Forms: from n/a through <= 5.0.4.
Product
Smart Marketing SMS and Newsletters Forms
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update Smart Marketing SMS and Newsletters Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 29, 2024DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatisCVE-2024-52782 · Other software · dcnglobal · reported by MITRECritical 9.8
DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/mon_stat_hist_new.php.
Product
dcme-320_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ba1100n.tech
Nov 29, 2024DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatisCVE-2024-52779 · Other software · dcnglobal · reported by MITRECritical 9.8
DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/mon_stat_top10.php.
Product
dcme-320_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ba1100n.tech
Nov 29, 2024DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatisCVE-2024-52778 · Other software · dcnglobal · reported by MITRECritical 9.8
DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/mon_stat_hist.php.
Product
dcme-320_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ba1100n.tech
Nov 19, 2024News Articles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51897 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erik Saulnier News Articles news-articles allows Stored XSS.This issue affects News Articles: from n/a through <= 1.0.0.
Product
News Articles
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update News Articles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024News Ticker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51830 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fazilatunnesa News Ticker newsticker allows Stored XSS.This issue affects News Ticker: from n/a through <= 1.0.
Product
News Ticker
Affected
up to 1.0
What to do
Affects up to 1.0. Update News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statementCVE-2024-9186 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Product
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
Fixed in
3.3.0
What to do
Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to 3.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 1, 2024ReviveNews: Missing AuthorizationCVE-2024-43974 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2.
Product
ReviveNews
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update ReviveNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Newspack: Broken Access ControlCVE-2024-43968 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Broken Access Control vulnerability in Automattic Newspack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack: from n/a through 3.8.6.
Product
Newspack
Affected
up to 3.8.6
What to do
Affects up to 3.8.6. Update Newspack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Newspack Content Converter: Missing AuthorizationCVE-2024-37477 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Automattic Newspack Content Converter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Content Converter: from n/a through 0.1.5.
Product
Newspack Content Converter
Affected
up to 0.1.5
What to do
Affects up to 0.1.5. Update Newspack Content Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Newspack Newsletters: Missing AuthorizationCVE-2024-37475 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Newspack Newsletters allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Newspack Newsletters: from n/a through 2.13.2.
Product
Newspack Newsletters
Affected
up to 2.13.2
What to do
Affects up to 2.13.2. Update Newspack Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Newsmatic: Missing AuthorizationCVE-2024-37468 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in blazethemes Newsmatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newsmatic: from n/a through 1.3.1.
Product
Newsmatic
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Newsmatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Newspack Blocks: Missing AuthorizationCVE-2024-37425 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Automattic Newspack Blocks newspack-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Blocks: from n/a through 3.0.8.
Product
Newspack Blocks
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Newspack Blocks: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37423 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8.
Product
Newspack Blocks
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Newsletters: Stored Cross-Site ScriptingCVE-2024-10181 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versions up to, and including, 4.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Newsletters
Affected
up to 4.9.9.4
What to do
Affects up to 4.9.9.4. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 28, 2024Meta News: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50435 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Meta News meta-news.This issue affects Meta News: from n/a through <= 1.1.7.
Product
Meta News
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Meta News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024NewsCard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-50434 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse NewsCard newscard.This issue affects NewsCard: from n/a through <= 1.3.
Product
NewsCard
Affected
up to 1.3
What to do
Affects up to 1.3. Update NewsCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2024Simple News: Stored Cross-Site ScriptingCVE-2024-10112 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'news' shortcode in all versions up to, and including, 2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple News
Affected
up to 2.8
What to do
Affects up to 2.8. Update Simple News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 23, 2024RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging: Unauthorized use of functionalityCVE-2024-9583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the wprss_ajax_send_premium_support function in all versions up to, and including, 4.23.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send premium support requests with an attacker-controlled subject line and email address to support allowing them to impersonate the site owner. License information may also be leaked.
Product
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
Affected
up to 4.23.12
What to do
Affects up to 4.23.12. Update RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2024News Kit Elementor Addons: Sensitive Information ExposureCVE-2024-9541 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in includes/widgets/canvas-menu/canvas-menu.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.
Product
News Kit Elementor Addons
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2024APA Register Newsletter Form: Cross-Site Request Forgery (CSRF)CVE-2024-49621 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari APA Register Newsletter Form apa-register-newsletter-form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through <= 1.0.0.
Product
APA Register Newsletter Form
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update APA Register Newsletter Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue): Cross-Site Request ForgeryCVE-2024-8477 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.87. This is due to missing or incorrect nonce validation on the Init() function. This makes it possible for unauthenticated attackers to log out of a Brevo connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue)
Affected
up to 3.1.87
What to do
Affects up to 3.1.87. Update Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 7, 2024OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/CVE-2024-45933 · Other software · online_news_portal_project · reported by MITREMedium 6.6
OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/post/edit/ endpoint.
Product
online_news_portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 6, 2024Newsletters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.1.
Product
Newsletters
Affected
up to 4.9.9.1
What to do
Affects up to 4.9.9.1. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024WP Newsletter Subscription: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44012 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpdev33 WP Newsletter Subscription wp-newsletter-subscription allows PHP Local File Inclusion.This issue affects WP Newsletter Subscription: from n/a through <= 1.1.
Product
WP Newsletter Subscription
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Newsletter Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 2, 2024Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid: Reflected Cross-Site ScriptingCVE-2024-9218 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
Affected
up to 1.3.14
What to do
Affects up to 1.3.14. Update Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 2, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Arbitrary shortcode executionCVE-2024-8254 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.34
What to do
Affects up to 5.7.34. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Unauthorized access of dataCVE-2024-8771 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'preview_email_template_design' function in all versions up to, and including, 5.7.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the content of private, password protected, pending, and draft posts and pages.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.34
What to do
Affects up to 5.7.34. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2024Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin: Stored Cross-Site ScriptingCVE-2024-8628 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-meta' shortcode in all versions up to, and including, 1.2.70.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin
Affected
up to 1.2.70.3
What to do
Affects up to 1.2.70.3. Update Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 18, 2024SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter.CVE-2024-44542 · Other software · todesk · reported by MITRECritical 9.8
SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter.
Product
todesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Sep 12, 2024MM-Breaking News: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-8056 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
MM-Breaking News
Affected
up to 0.7.9
What to do
Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024MM-Breaking News: Does not have CSRF check in some placesCVE-2024-8054 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
MM-Breaking News
Affected
up to 0.7.9
What to do
Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 6, 2024Newsletters: Privilege escalationCVE-2024-8247 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restricting what user meta can be updated as screen options. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator. Please note that this only affects users with access to edit/update screen options, which means an administrator would need to grant lower privilege users with access to the Sent & Draft Emails page of the plugin in order for this to be exploited.
Product
Newsletters
Affected
up to 4.9.9.2
What to do
Affects up to 4.9.9.2. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 3, 2024A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML viaCVE-2024-44920 · Other software · seacms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the siteurl parameter.
Product
seacms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 28, 2024Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allows attackers to accesCVE-2024-44760 · Other software · sunmochina · reported by MITREHigh 7.5
Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allows attackers to access sensitive information regarding the server.
Product
enterprise_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.