Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

502 results · page 8 of 11

Apr 9, 2024WooCommerce Cloak Affiliate Links: Unauthorized modification of dataCVE-2024-1308 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate links.
Product
WooCommerce Cloak Affiliate Links
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update WooCommerce Cloak Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2024WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function.CVE-2023-5692 · WordPress plugins & themes · reported by WordfenceMedium 5.3
WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record core.trac.wordpress.org developer.wordpress.org
Mar 28, 2024MainWP Links Manager Extension: Deserialization of Untrusted DataCVE-2023-23649 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2.1.
Product
MainWP Links Manager Extension
Affected
up to 2.1
What to do
Affects up to 2.1. Update MainWP Links Manager Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Pz-LinkCard: Does not prevent users from pinging arbitrary hosts via some of its shortcodesCVE-2024-0677 · WordPress plugins & themes · reported by WPScanMedium 5.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
Product
Pz-LinkCard
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2024Pz-LinkCard: Does not sanitise and escape some of its settingsCVE-2024-0673 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Pz-LinkCard
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2024Pz-LinkCard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0672 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Pz-LinkCard
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2024Shortlinks by Pretty Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pretty Links Shortlinks by Pretty Links allows Reflected XSS.This issue affects Shortlinks by Pretty Links: from n/a through 3.6.2.
Product
Shortlinks by Pretty Links
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Shortlinks by Pretty Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024SEO Backlink Monitor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29907 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Active Websight SEO Backlink Monitor allows Reflected XSS.This issue affects SEO Backlink Monitor: from n/a through 1.5.0.
Product
SEO Backlink Monitor
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update SEO Backlink Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2024Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing: Cross-Site Request ForgeryCVE-2024-2326 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's configuration including stripe integration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Permalink Manager Lite: Unauthorized modification of dataCVE-2024-2538 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.
Product
Permalink Manager Lite
Affected
up to 2.4.3.1
What to do
Affects up to 2.4.3.1. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Mar 19, 2024Permalink Manager Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29092 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.
Product
Permalink Manager Lite
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Link Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29123 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6.
Product
Link Library
Affected
up to 7.6
What to do
Affects up to 7.6. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Broken Link Checker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25592 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link Checker: from n/a through 2.2.3.
Product
Broken Link Checker
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Auto Affiliate Links: Unauthorized modification of dataCVE-2024-1843 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aalAddLink function in all versions up to, and including, 6.4.3. This makes it possible for authenticated attackers, with subscriber access or higher, to add arbitrary links to posts.
Product
Auto Affiliate Links
Affected
up to 6.4.3
What to do
Affects up to 6.4.3. Update Auto Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2024Link Library: Stored Cross-Site ScriptingCVE-2024-1559 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Link Library
Affected
up to 7.6
What to do
Affects up to 7.6. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 12, 2024Link Library: Cross-Site Request Forgery (CSRF)CVE-2024-24875 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.This issue affects Link Library: from n/a through 7.5.13.
Product
Link Library
Affected
up to 7.5.13
What to do
Affects up to 7.5.13. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 9, 2024Internal Link Juicer: SEO Auto Linker for: Stored Cross-Site ScriptingCVE-2024-0657 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Internal Link Juicer: SEO Auto Linker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings such as 'ilj_settings_field_links_per_page' in all versions up to, and including, 2.23.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Internal Link Juicer: SEO Auto Linker for
Affected
up to 2.23.4
What to do
Affects up to 2.23.4. Update Internal Link Juicer: SEO Auto Linker for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 8, 2024Link Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24879 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.5.13.
Product
Link Library
Affected
up to 7.5.13
What to do
Affects up to 7.5.13. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Auto Amazon Links – Amazon Associates Affiliate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52175 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Uno (miunosoft) Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1.
Product
Auto Amazon Links – Amazon Associates Affiliate
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Auto Amazon Links – Amazon Associates Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Better Anchor Links: Cross-Site Request Forgery (CSRF)CVE-2024-22287 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links: from n/a through 1.7.5.
Product
Better Anchor Links
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Better Anchor Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Link Whisper Free: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47852 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.
Product
Link Whisper Free
Affected
up to 0.6.5
What to do
Affects up to 0.6.5. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Smart External Link Click Monitor [Link Log]: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49771 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Link Log] allows Reflected XSS.This issue affects Smart External Link Click Monitor [Link Log]: from n/a through 5.0.2.
Product
Smart External Link Click Monitor [Link Log]
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Smart External Link Click Monitor [Link Log] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Smart External Link Click Monitor [Link Log]: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49770 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Link Log] allows Stored XSS.This issue affects Smart External Link Click Monitor [Link Log]: from n/a through 5.0.2.
Product
Smart External Link Click Monitor [Link Log]
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Smart External Link Click Monitor [Link Log] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Email download link: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7.
Product
Email download link
Affected
up to 3.7
What to do
Affects up to 3.7. Update Email download link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Broken Link Checker for YouTube: Cross-Site Request Forgery (CSRF)CVE-2023-48281 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Super Blog Me Broken Link Checker for YouTube allows Cross Site Request Forgery.This issue affects Broken Link Checker for YouTube: from n/a through 1.3.
Product
Broken Link Checker for YouTube
Affected
up to 1.3
What to do
Affects up to 1.3. Update Broken Link Checker for YouTube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-40674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management allows Stored XSS.This issue affects Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: from n/a through 118.
Product
Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management
Affected
up to 118
What to do
Affects up to 118. Update Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023Martins Free & Easy SEO BackLink Link Building Network: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Martins Free & Easy SEO BackLink Link Building Network
Fixed in
1.2.30
What to do
Update Martins Free & Easy SEO BackLink Link Building Network to 1.2.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in Poporon Pz-LinkCard plugin <= 2.4.8 versions.CVE-2023-47790 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in Poporon Pz-LinkCard plugin <= 2.4.8 versions.
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versCVE-2023-47773 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions.
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2023WP Links Page: Cross-Site Request Forgery (CSRF)CVE-2023-47651 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Robert Macchi WP Links Page.This issue affects WP Links Page: from n/a through 4.9.4.
Product
WP Links Page
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update WP Links Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Auto Affiliate Links: Cross-Site Request Forgery (CSRF)CVE-2023-47652 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links allows Stored XSS.This issue affects Auto Affiliate Links: from n/a through 6.4.2.4.
Product
Auto Affiliate Links
Affected
up to 6.4.2.4
What to do
Affects up to 6.4.2.4. Update Auto Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Autolinks Manager plugin <= 1.10.04 versions.CVE-2023-46625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Autolinks Manager plugin <= 1.10.04 versions.
Affected
up to 1.10.04
What to do
Affects up to 1.10.04. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <= 2.0.1 versions.CVE-2023-34033 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <= 2.0.1 versions.
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Telephone Number Linker: Stored Cross-Site ScriptingCVE-2023-5743 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Telephone Number Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'telnumlink' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Telephone Number Linker
Affected
up to 1.2
What to do
Affects up to 1.2. Update Telephone Number Linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2023ImageLinks Interactive Image Builder for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-46823 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum ImageLinks Interactive Image Builder for WordPress allows SQL Injection.This issue affects ImageLinks Interactive Image Builder for WordPress: from n/a through 1.5.4.
Product
ImageLinks Interactive Image Builder for
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update ImageLinks Interactive Image Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions.CVE-2023-46193 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions.
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole Smooth Scroll Links [SSL] plugin <= 1.1.0 versions.CVE-2023-46095 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole Smooth Scroll Links [SSL] plugin <= 1.1.0 versions.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023WP Mailto Links – Protect Email Addresses: Stored Cross-Site ScriptingCVE-2023-5109 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 3.1.3 and fully patched in version 3.1.4.
Product
WP Mailto Links – Protect Email Addresses
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update WP Mailto Links – Protect Email Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Auto Amazon Links: Stored Cross-Site ScriptingCVE-2023-4482 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Auto Amazon Links
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Auto Amazon Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Video Playlist For YouTube plugin <= 6.0 versions.CVE-2023-45653 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Video Playlist For YouTube plugin <= 6.0 versions.
Affected
up to 6.0
What to do
Affects up to 6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions.CVE-2023-45103 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions.
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Morris Bryant, Ruben Sargsyan Outbound Link Manager plugin <= 1.2 versions.CVE-2023-41850 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Morris Bryant, Ruben Sargsyan Outbound Link Manager plugin <= 1.2 versions.
Affected
up to 1.2
What to do
Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <= 2.1.4 versions.CVE-2023-37990 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <= 2.1.4 versions.
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Greeklish-permalink: Does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX actionCVE-2023-2495 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
Product
Greeklish-permalink
Affected
up to 3.3
What to do
Affects up to 3.3. Update Greeklish-permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 28, 2023WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Authentication bypassCVE-2023-2982 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
Product
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
Affected
up to 7.6.4
What to do
Affects up to 7.6.4. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Unauthorized permalink structure updateCVE-2023-1843 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2023Pretty Links: Stored Cross-Site ScriptingCVE-2019-25147 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pretty Links
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Pretty Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 4, 2023A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress.CVE-2014-125105 · WordPress plugins & themes · reported by VulDBLow 2.4
A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of the argument exclusion_list/blc_custom_fields leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.10.2 is able to address this issue. The patch is named 90615fe9b0b6f9e6fb254d503c302e53a202e561. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230659.
Product
Broken Link Checker
Affected
up to 1.10.1
What to do
Affects up to 1.10.1. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pretty Links plugin <= 3.4.0 versions.CVE-2022-47149 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pretty Links plugin <= 3.4.0 versions.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tim Eckel Read More Excerpt Link plugin <= 1.6 versions.CVE-2023-26011 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tim Eckel Read More Excerpt Link plugin <= 1.6 versions.
Affected
up to 1.6
What to do
Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.