Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

472 results · page 7 of 10

Dec 24, 2024Booking Calendar WpDevArt: Time-based, blind SQL injectionCVE-2024-10856 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerability requires the “delete_prev_date” theme option being enabled. This makes it possible for authenticated attackers, with contributor-level access or above, to append additional SQL queries into already existing query that can be used to extract sensitive information such as passwords from the database.
Product
Booking Calendar WpDevArt
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Booking Calendar WpDevArt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024Pingmeter Uptime Monitoring: Reflected Cross-Site ScriptingCVE-2024-11808 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pingmeter Uptime Monitoring plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Pingmeter Uptime Monitoring
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Pingmeter Uptime Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 21, 2024WP Docs: Time-based SQL InjectionCVE-2024-12635 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability was partially patched in version 2.2.0.
Product
WP Docs
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2024Order Delivery & Pickup Location Date Time: Missing AuthorizationCVE-2024-55997 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in webchunky Order Delivery & Pickup Location Date Time order-delivery-pickup-location-date-time-free-version allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery & Pickup Location Date Time: from n/a through <= 1.1.0.
Product
Order Delivery & Pickup Location Date Time
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Order Delivery & Pickup Location Date Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Travel Booking: Blind time-based SQL InjectionCVE-2024-11912 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and including, 3.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Travel Booking
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Travel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record travelerwp.com wordfence.com
Dec 16, 2024Utech World Time: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54441 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time utech-world-time-for-wp allows Stored XSS.This issue affects Utech World Time: from n/a through <= 1.0.
Product
Utech World Time
Affected
up to 1.0
What to do
Affects up to 1.0. Update Utech World Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling: Unauthorized loss of dataCVE-2024-11275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.
Product
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Arena.IM – Live Blogging for real-time events: Cross-Site Request ForgeryCVE-2024-12526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.1. This is due to missing or incorrect nonce validation on the 'albfre_user_action' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Arena.IM – Live Blogging for real-time events
Affected
up to 0.4.1
What to do
Affects up to 0.4.1. Update Arena.IM – Live Blogging for real-time events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Arena.IM – Live Blogging for real-time events: Stored Cross-Site ScriptingCVE-2024-12463 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arena_embed_amp' shortcode in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Arena.IM – Live Blogging for real-time events
Affected
up to 0.4.1
What to do
Affects up to 0.4.1. Update Arena.IM – Live Blogging for real-time events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Arena.IM – Live Blogging for real-time events: Stored Cross-Site ScriptingCVE-2024-11384 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode in all versions up to, and including, 0.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Arena.IM – Live Blogging for real-time events
Affected
up to 0.3.0
What to do
Affects up to 0.3.0. Update Arena.IM – Live Blogging for real-time events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2024Elementor Timeline Widget: Missing AuthorizationCVE-2023-49755 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in B.M. Rafiul Alam Elementor Timeline Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Timeline Widget: from n/a through 2.2.
Product
Elementor Timeline Widget
Affected
up to 2.2
What to do
Affects up to 2.2. Update Elementor Timeline Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024WP Time Slots Booking Form: Missing AuthorizationCVE-2023-23895 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through 1.1.82.
Product
WP Time Slots Booking Form
Affected
up to 1.1.82
What to do
Affects up to 1.1.82. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 5, 2024Video Gallery – Best WordPress YouTube Gallery: Time-based SQL InjectionCVE-2024-10247 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Video Gallery – Best WordPress YouTube Gallery
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Video Gallery – Best WordPress YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Dec 3, 2024BP Profile Shortcodes Extra: Time-based SQL InjectionCVE-2024-11732 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tab’ parameter in all versions up to, and including, 2.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
BP Profile Shortcodes Extra
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update BP Profile Shortcodes Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 1, 2024Countdown Timer for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53743 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aezaz Shaikh Countdown Timer for Elementor countdown-timer-for-elementor allows Stored XSS.This issue affects Countdown Timer for Elementor: from n/a through <= 1.3.6.
Product
Countdown Timer for Elementor
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Countdown Timer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 27, 2024Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic): Time-based SQL InjectionCVE-2024-11009 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic)
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 23, 2024Increase Maximum Upload File Size | Increase Execution Time: Full Path DisclosureCVE-2024-11265 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.3. This is due to returning image upload error messages with full path information. This makes it possible for authenticated attackers, with author-level permissions and above, to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Increase Maximum Upload File Size | Increase Execution Time
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Increase Maximum Upload File Size | Increase Execution Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2024PF Timer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51863 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Profit Funnels PF Timer pf-timer allows Stored XSS.This issue affects PF Timer: from n/a through <= 1.0.0.
Product
PF Timer
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update PF Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024World Prayer Time: Cross-Site Request Forgery (CSRF)CVE-2024-50534 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in techdabang World Prayer Time world-prayer-time allows Stored XSS.This issue affects World Prayer Time: from n/a through <= 2.0.
Product
World Prayer Time
Affected
up to 2.0
What to do
Affects up to 2.0. Update World Prayer Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 16, 2024Login using WordPress Users ( WP as SAML IDP ): Time-based SQL InjectionCVE-2024-9887 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Login using WordPress Users ( WP as SAML IDP )
Affected
up to 1.15.6
What to do
Affects up to 1.15.6. Update Login using WordPress Users ( WP as SAML IDP ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 16, 2024Blogger 301 Redirect: Blind time-based SQL InjectionCVE-2024-10645 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Blogger 301 Redirect plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘br’ parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Blogger 301 Redirect
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Blogger 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 16, 2024Backup and Staging by WP Time Capsule: Arbitrary file uploadsCVE-2024-8856 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.21
What to do
Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hacked.be plugins.trac.wordpress.org
Nov 9, 2024Twitter real time search scrolling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51716 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Twitter real time search scrolling twitter-real-time-search-scrolling allows Reflected XSS.This issue affects Twitter real time search scrolling: from n/a through <= 7.0.
Product
Twitter real time search scrolling
Affected
up to 7.0
What to do
Affects up to 7.0. Update Twitter real time search scrolling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Poll Maker – Versus Polls, Anonymous Polls, Image Polls: Time-based SQL InjectionCVE-2024-9874 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Affected
up to 5.4.6
What to do
Affects up to 5.4.6. Update Poll Maker – Versus Polls, Anonymous Polls, Image Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Nov 9, 2024Countdown Timer block – Display the event's date into a timer.: Information ExposureCVE-2024-10669 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the [ctb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Countdown Timer block – Display the event's date into a timer.
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Countdown Timer block – Display the event's date into a timer. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2024Timetics: Missing AuthorizationCVE-2024-43923 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Timetics: from n/a through 1.0.23.
Product
Timetics
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Timetics: Missing AuthorizationCVE-2024-37427 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.21.
Product
Timetics
Affected
up to 1.0.21
What to do
Affects up to 1.0.21. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Time Slot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50418 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Time Slot Booking Time Slot timeslot allows DOM-Based XSS.This issue affects Time Slot: from n/a through <= 1.3.6.
Product
Time Slot
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Time Slot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2024WP Sessions Time Monitoring Full Automatic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49681 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows SQL Injection.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.0.9.
Product
WP Sessions Time Monitoring Full Automatic
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2024HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce: Unauthorized post publicationCVE-2024-8667 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to a missing capability check on the activateCampaign() function in all versions up to, and including, 2.10.0. This makes it possible for authenticated attackers, with contributor-level access and above, to publish arbitrary posts like ones they have submitted for review, or a site administrator has in draft.
Product
HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 23, 2024Backup and Staging by WP Time Capsule: Deserialization of Untrusted DataCVE-2024-49684 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.21
What to do
Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) aCVE-2024-9593 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 17, 2024Ahmeti Wp Timeline: Cross-Site Request Forgery (CSRF)CVE-2024-49237 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Timeline ahmeti-wp-timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n/a through <= 5.1.
Product
Ahmeti Wp Timeline
Affected
up to 5.1
What to do
Affects up to 5.1. Update Ahmeti Wp Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling: Account Takeover/Privilege EscalationCVE-2024-9263 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including administrators, which makes account takeover and privilege escalation possible.
Product
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling
Affected
up to 1.0.25
What to do
Affects up to 1.0.25. Update WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024Timetable and Event Schedule by MotoPress: Authorization bypassCVE-2020-36840 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.
Product
Timetable and Event Schedule by MotoPress
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update Timetable and Event Schedule by MotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 11, 2024Backup and Staging by WP Time Capsule: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-48020 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.21
What to do
Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2024Increase upload file size & Maximum Execution Time limit: Reflected Cross-Site ScriptingCVE-2024-9611 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Increase upload file size & Maximum Execution Time limit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Increase upload file size & Maximum Execution Time limit
Affected
up to 2.0
What to do
Affects up to 2.0. Update Increase upload file size & Maximum Execution Time limit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 6, 2024WP Timeline – Vertical and Horizontal timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines allows Reflected XSS.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
Product
WP Timeline – Vertical and Horizontal timeline
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update WP Timeline – Vertical and Horizontal timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024WP Timeline – Vertical and Horizontal timeline: Path Traversal: '.../...//'CVE-2024-47324 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
Product
WP Timeline – Vertical and Horizontal timeline
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update WP Timeline – Vertical and Horizontal timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024WP Timeline – Vertical and Horizontal timeline: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-47323 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
Product
WP Timeline – Vertical and Horizontal timeline
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update WP Timeline – Vertical and Horizontal timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2024WP Easy Gallery – WordPress Gallery: Time-based SQL InjectionCVE-2024-9018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Easy Gallery – WordPress Gallery
Affected
up to 4.8.5
What to do
Affects up to 4.8.5. Update WP Easy Gallery – WordPress Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 27, 2024GiveWP – Donation Plugin and Fundraising Platform: Time-based SQL InjectionCVE-2024-9130 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, that can be used to extract sensitive information from the database.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.16.1
What to do
Affects up to 3.16.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record givewp.com plugins.trac.wordpress.org
Sep 24, 2024Daily Prayer Time: SQL InjectionCVE-2024-8621 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'max_word' attribute of the 'quran_verse' shortcode in all versions up to, and including, 2024.08.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Daily Prayer Time
Affected
up to 2024.08.26
What to do
Affects up to 2024.08.26. Update Daily Prayer Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2024WP Events Manager: Time-based SQL InjectionCVE-2024-7717 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Events Manager
Affected
up to 2.1.11
What to do
Affects up to 2.1.11. Update WP Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024Front End Users: Time-based SQL InjectionCVE-2024-7607 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Front End Users
Affected
up to 3.2.28
What to do
Affects up to 3.2.28. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2024Timeline and History slider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43232 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP OnlineSupport, Essential Plugin Timeline and History slider allows PHP Local File Inclusion.This issue affects Timeline and History slider: from n/a through 2.3.
Product
Timeline and History slider
Affected
up to 2.3
What to do
Affects up to 2.3. Update Timeline and History slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Bold Timeline Lite: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43294 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BoldThemes Bold Timeline Lite allows Stored XSS.This issue affects Bold Timeline Lite: from n/a through 1.2.0.
Product
Bold Timeline Lite
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Bold Timeline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 8, 2024LearnPress – WordPress LMS: Time-based SQL InjectionCVE-2024-7548 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 4.2.6.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.9.3
What to do
Affects up to 4.2.6.9.3. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Aug 8, 2024Slider by 10Web – Responsive Image Slider: Time-based SQL InjectionCVE-2024-7150 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Slider by 10Web – Responsive Image Slider
Affected
up to 1.2.57
What to do
Affects up to 1.2.57. Update Slider by 10Web – Responsive Image Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2024Timetable and Event Schedule: Deserialization of Untrusted DataCVE-2024-39630 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedule: from n/a through 2.4.13.
Product
Timetable and Event Schedule
Affected
up to 2.4.13
What to do
Affects up to 2.4.13. Update Timetable and Event Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.