Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

427 results · page 7 of 9

Apr 24, 2024Advanced Floating Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32723 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Tides Advanced Floating Content allows Stored XSS.This issue affects Advanced Floating Content: from n/a through 1.2.5.
Product
Advanced Floating Content
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Advanced Floating Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024BWL Advanced FAQ Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32136 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xenioushk BWL Advanced FAQ Manager.This issue affects BWL Advanced FAQ Manager: from n/a through 2.0.3.
Product
BWL Advanced FAQ Manager
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update BWL Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Advanced Page Visit Counter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32098 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter.This issue affects Advanced Page Visit Counter: from n/a through 8.0.6.
Product
Advanced Page Visit Counter
Affected
up to 8.0.6
What to do
Affects up to 8.0.6. Update Advanced Page Visit Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Advanced iFrame: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2024.2.
Product
Advanced iFrame
Affected
up to 2024.2
What to do
Affects up to 2024.2. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Advanced Search: Does not have CSRF checks in some placesCVE-2024-2739 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Product
Advanced Search
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Advanced Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2024Advanced Cron Manager – debug & control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31926 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BracketSpace Advanced Cron Manager – debug & control allows Stored XSS.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.2.
Product
Advanced Cron Manager – debug & control
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Advanced Cron Manager – debug & control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Advanced Classifieds & Directory Pro: Unauthorized loss of dataCVE-2024-2222 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads.
Product
Advanced Classifieds & Directory Pro
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WP Reset – Most Advanced WordPress Reset Tool: Sensitive Information ExposureCVE-2023-6799 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible for unauthenticated attackers to extract sensitive data including site backups by brute-forcing the snapshot filenames. Please note that the vendor does not plan to do any further hardening on this functionality.
Product
WP Reset – Most Advanced WordPress Reset Tool
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP Reset – Most Advanced WordPress Reset Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 27, 2024Advanced Sermons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29928 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issue affects Advanced Sermons: from n/a through 3.1.
Product
Advanced Sermons
Affected
up to 3.1
What to do
Affects up to 3.1. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: SQL InjectionCVE-2024-2387 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms plugin for WordPress is vulnerable to SQL Injection via the ‘integration_id’ parameter in all versions up to, and including, 1.82.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries and subsequently inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms
Affected
up to 1.82.0
What to do
Affects up to 1.82.0. Update Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2024Advanced Access Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29124 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Stored XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.
Product
Advanced Access Manager
Affected
up to 6.9.20
What to do
Affects up to 6.9.20. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Advanced Access Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29127 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Reflected XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.
Product
Advanced Access Manager
Affected
up to 6.9.20
What to do
Affects up to 6.9.20. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2024Advanced Social Feeds Widget & Shortcode: Does not sanitise and escape some of its settingsCVE-2024-0951 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Advanced Social Feeds Widget & Shortcode
Affected
up to 1.7
What to do
Affects up to 1.7. Update Advanced Social Feeds Widget & Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2024Advanced Sermons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27952 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issue affects Advanced Sermons: from n/a through 3.2.
Product
Advanced Sermons
Affected
up to 3.2
What to do
Affects up to 3.2. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 11, 2024Enhanced Text Widget: Does not validate and escape some of its Widget options before outputting them back in attributesCVE-2024-0559 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Enhanced Text Widget
Fixed in
1.6.6
What to do
Update Enhanced Text Widget to 1.6.6 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Feb 29, 2024Advanced iFrame: Stored Cross-Site ScriptingCVE-2024-1341 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advanced_iframe shortcode in all versions up to, and including, 2024.1 due to the plugin allowing users to include JS files from external sources through the additional_js attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced iFrame
Affected
up to 2024.1
What to do
Affects up to 2024.1. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Advanced Flamingo: Cross-Site Request Forgery (CSRF)CVE-2023-52226 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.
Product
Advanced Flamingo
Affected
up to 1.0
What to do
Affects up to 1.0. Update Advanced Flamingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024TinyMCE and TinyMCE Advanced Professsional Formats and Styles: Cross-Site Request Forgery (CSRF)CVE-2024-25904 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Stockl TinyMCE and TinyMCE Advanced Professsional Formats and Styles.This issue affects TinyMCE and TinyMCE Advanced Professsional Formats and Styles: from n/a through 1.1.2.
Product
TinyMCE and TinyMCE Advanced Professsional Formats and Styles
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update TinyMCE and TinyMCE Advanced Professsional Formats and Styles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024EazyDocs: Re-introduced CVE-2023-6029 (https://wpscanCVE-2024-0248 · WordPress plugins & themes · reported by WPScanMedium 4.3
The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 (https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/) in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was partially fixed in 2.3.9.
Product
EazyDocs
Fixed in
2.4.0
What to do
Update EazyDocs to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 5, 2024Advanced Forms for ACF: Unauthorized access of dataCVE-2024-1121 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_json_file() function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings.
Product
Advanced Forms for ACF
Affected
up to 1.9.3.2
What to do
Affects up to 1.9.3.2. Update Advanced Forms for ACF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Advanced Database Cleaner: PHP Object InjectionCVE-2024-0668 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of untrusted input in the 'process_bulk_action' function. This makes it possible for authenticated attacker, with administrator access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Advanced Database Cleaner
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Advanced Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Advanced Custom Fields (ACF): Stored Cross-Site ScriptingCVE-2023-6701 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom text field in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Custom Fields (ACF)
Affected
up to 6.2.4
What to do
Affects up to 6.2.4. Update Advanced Custom Fields (ACF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org advancedcustomfields.com
Feb 5, 2024Advanced iFrame: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.10.
Product
Advanced iFrame
Affected
up to 2023.10
What to do
Affects up to 2023.10. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Advanced iFrame: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51690 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.8.
Product
Advanced iFrame
Affected
up to 2023.8
What to do
Affects up to 2023.8. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Advanced iFrame: Stored Cross-Site ScriptingCVE-2023-7069 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2023.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-24870 is likely a duplicate of this issue.
Product
Advanced iFrame
Affected
up to 2023.10
What to do
Affects up to 2023.10. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2024Advanced Local Pickup for WooCommerce: Missing AuthorizationCVE-2022-40702 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.5.2.
Product
Advanced Local Pickup for WooCommerce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Advanced Local Pickup for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Advanced Dynamic Pricing for WooCommerce: Missing AuthorizationCVE-2022-40203 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through 4.1.5.
Product
Advanced Dynamic Pricing for WooCommerce
Affected
up to 4.1.5
What to do
Affects up to 4.1.5. Update Advanced Dynamic Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 16, 2024The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-SCVE-2021-24432 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-Site Scripting issue.
Fixed in
1.5.4.7
What to do
Update the plugin to 1.5.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 13, 2024Advanced Woo Search: Reflected Cross-Site ScriptingCVE-2024-0251 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced Woo Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search parameter in all versions up to, and including, 2.96 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects sites when the Dynamic Content for Elementor plugin is also installed.
Product
Advanced Woo Search
Affected
up to 2.96
What to do
Affects up to 2.96. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 8, 2024Advanced Custom Fields (ACF): Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-40696 · WordPress plugins & themes · reported by PatchstackLow 3.7
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.
Product
Advanced Custom Fields (ACF)
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Advanced Custom Fields (ACF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51675 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.15
What to do
Affects up to 6.9.15. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Squirrly SEO - Advanced Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50854 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly Squirrly SEO - Advanced Pack.This issue affects Squirrly SEO - Advanced Pack: from n/a before 2.4.02.
Product
Squirrly SEO - Advanced Pack
Fixed in
2.4.02
What to do
Update Squirrly SEO - Advanced Pack to 2.4.02 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50853 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms.This issue affects Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: from n/a through 1.75.0.
Product
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms
Affected
up to 1.75.0
What to do
Affects up to 1.75.0. Update Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Advanced Page Visit Counter – Most Wanted Analytics Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28788 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 6.4.2.
Product
Advanced Page Visit Counter – Most Wanted Analytics Plugin for
Affected
up to 6.4.2
What to do
Affects up to 6.4.2. Update Advanced Page Visit Counter – Most Wanted Analytics Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Advanced Category Template: Cross-Site Request Forgery (CSRF)CVE-2023-50835 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Praveen Goswami Advanced Category Template.This issue affects Advanced Category Template: from n/a through 0.1.
Product
Advanced Category Template
Affected
up to 0.1
What to do
Affects up to 0.1. Update Advanced Category Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Advanced Database Cleaner: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49764 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Younes JFR. Advanced Database Cleaner.This issue affects Advanced Database Cleaner: from n/a through 3.1.2.
Product
Advanced Database Cleaner
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Advanced Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Advanced Page Visit Counter – Most Wanted Analytics Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50371 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress allows Stored XSS.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 8.0.6.
Product
Advanced Page Visit Counter – Most Wanted Analytics Plugin for
Affected
up to 8.0.6
What to do
Affects up to 8.0.6. Update Advanced Page Visit Counter – Most Wanted Analytics Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Advanced Local Pickup for WooCommerce: Time-based SQL InjectionCVE-2023-2841 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with admin-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Advanced Local Pickup for WooCommerce
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Advanced Local Pickup for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 13, 2023Advanced iFrame: Stored Cross-Site ScriptingCVE-2023-4775 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including, 2023.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2023-51690 appears to be a potential duplicate of this issue.
Product
Advanced iFrame
Affected
up to 2023.8
What to do
Affects up to 2023.8. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.CVE-2023-28618 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.
Affected
up to 1.16
What to do
Affects up to 1.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Advanced Page Visit Counter – Most Wanted Analytics Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-45074 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress allows SQL Injection.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 7.1.1.
Product
Advanced Page Visit Counter – Most Wanted Analytics Plugin for
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update Advanced Page Visit Counter – Most Wanted Analytics Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 25, 2023Advanced Menu Widget: Stored Cross-Site ScriptingCVE-2023-5085 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'advMenu' shortcode in versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Menu Widget
Affected
up to 0.4.1
What to do
Affects up to 0.4.1. Update Advanced Menu Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Advanced Custom Fields: Extended: Stored Cross-Site ScriptingCVE-2023-5292 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Custom Fields: Extended
Affected
up to 0.8.9.3
What to do
Affects up to 0.8.9.3. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions.CVE-2023-40561 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Enhanced Ecommerce Google Analytics for WooCommerce plugin <= 3.7.1 versions.
Fixed in
3.7.1
What to do
Update the plugin to 3.7.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 4, 2023Advanced File Manager: Does not adequately authorize its usage on multisite installationsCVE-2023-3814 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.
Product
Advanced File Manager
Fixed in
5.1.1
What to do
Update Advanced File Manager to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 21, 2023Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7: Cross-site scriptingCVE-2023-40068 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.
Product
Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7
What to do
Update Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 12, 2023Advanced Popups: Cross-Site Request ForgeryCVE-2021-4421 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Popups plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the metabox_popup_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Advanced Popups
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Advanced Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce sCVE-2023-34015 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin <= 1.6.4.4 versions.
Fixed in
1.6.4.6
What to do
Update the plugin to 1.6.4.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.