Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
697 results · page 8 of 14
Jan 8, 2025WordPress File Upload: Path TraversalCVE-2024-9939 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory.
- Product
- WordPress File Upload
- Affected
- up to 4.24.13
- What to do
- Affects up to 4.24.13. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordabrahack.complugins.trac.wordpress.org
Jan 8, 2025InfiniteWP Client: Path TraversalCVE-2024-10585 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory.
- Product
- InfiniteWP Client
- Affected
- up to 1.13.0
- What to do
- Affects up to 1.13.0. Update InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for CVE-2024-11826 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Classic Addons – WPBakery Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-56286 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-addons-wpbakery-page-builder-addons allows PHP Local File Inclusion.This issue affects Classic Addons – WPBakery Page Builder: from n/a through <= 3.0.
- Product
- Classic Addons – WPBakery Page Builder
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Classic Addons – WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025SMSA Shipping: Path Traversal: '.../...//'CVE-2024-49249 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through <= 2.3.
- Product
- SMSA Shipping
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update SMSA Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025MIPL WC Multisite Sync: Directory TraversalCVE-2024-12152 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download_log' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- MIPL WC Multisite Sync
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update MIPL WC Multisite Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2025WPMasterToolKit: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-56248 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Path Traversal.This issue affects WPMasterToolKit: from n/a through <= 1.13.1.
- Product
- WPMasterToolKit
- Affected
- up to 1.13.1
- What to do
- Affects up to 1.13.1. Update WPMasterToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WPLMS: Path Traversal: '.../...//'CVE-2024-56045 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.
- Product
- WPLMS
- Fixed in
- 1.9.9.5
- What to do
- Update WPLMS to 1.9.9.5 or newer.
Dec 31, 2024Userpro: Path Traversal: '.../...//'CVE-2024-56214 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro userpro allows Path Traversal.This issue affects Userpro: from n/a through <= 5.1.9.
- Product
- Userpro
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Eventin: Path Traversal: '.../...//'CVE-2024-56213 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7.
- Product
- Eventin
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2024Database Backup and check Tables Automated With Scheduler 2024: Directory TraversalCVE-2024-12850 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the database_backup_ajax_download() function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Database Backup and check Tables Automated With Scheduler 2024
- Affected
- up to 2.32
- What to do
- Affects up to 2.32. Update Database Backup and check Tables Automated With Scheduler 2024 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Dec 21, 2024Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: Directory TraversalCVE-2024-12875 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Easy Digital Downloads – eCommerce Payments and Subscriptions made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2024WPLMS: Path Traversal: '.../...//'CVE-2024-56055 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.2
- What to do
- Update WPLMS to 1.9.9.5.2 or newer.
Dec 18, 2024WPLMS: Path Traversal: '.../...//'CVE-2024-56049 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.2
- What to do
- Update WPLMS to 1.9.9.5.2 or newer.
Dec 16, 2024Bold Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54382 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Traversal.This issue affects Bold Page Builder: from n/a through <= 5.1.5.
- Product
- Bold Page Builder
- Affected
- up to 5.1.5
- What to do
- Affects up to 5.1.5. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP Cookies Enabler: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54380 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Filippo Bodei WP Cookies Enabler wp-cookies-enabler allows PHP Local File Inclusion.This issue affects WP Cookies Enabler: from n/a through <= 1.0.1.
- Product
- WP Cookies Enabler
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Cookies Enabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Woolook: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54375 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Woolook woolook allows PHP Local File Inclusion.This issue affects Woolook: from n/a through <= 1.7.0.
- Product
- Woolook
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Woolook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Sogrid: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54374 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Sogrid sogrid allows PHP Local File Inclusion.This issue affects Sogrid: from n/a through <= 1.5.6.
- Product
- Sogrid
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Sogrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024EduAdmin Booking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54373 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chris Gardenberg EduAdmin Booking eduadmin-booking allows PHP Local File Inclusion.This issue affects EduAdmin Booking: from n/a through <= 5.2.0.
- Product
- EduAdmin Booking
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update EduAdmin Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024UNIVERSAM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54327 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in universam UNIVERSAM universam-demo allows Reflected XSS.This issue affects UNIVERSAM: from n/a through < 8.59.
- Product
- UNIVERSAM
- What to do
- Update UNIVERSAM to the newest version.
Dec 13, 2024FULL Customer: Path TraversalCVE-2024-54313 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal vulnerability in FULL. FULL Customer allows Path Traversal.This issue affects FULL Customer: from n/a through 3.1.25.
- Product
- FULL Customer
- Affected
- up to 3.1.25
- What to do
- Affects up to 3.1.25. Update FULL Customer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024DELUCKS SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54259 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
- Product
- DELUCKS SEO
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 10, 2024Best WordPress Gallery Plugin – FooGallery: Directory TraversalCVE-2023-6947 · WordPress plugins & themes · reported by WordfenceHigh 7.7
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure.
- Product
- Best WordPress Gallery Plugin – FooGallery
- Affected
- up to 2.4.26
- What to do
- Affects up to 2.4.26. Update Best WordPress Gallery Plugin – FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Dec 9, 2024Lenxel Core for Lenxel(LNX) LMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-53790 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PHP Local File Inclusion.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.
- Product
- Lenxel Core for Lenxel(LNX) LMS
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Lenxel Core for Lenxel(LNX) LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024ARForms: Path Traversal: '.../...//'CVE-2024-54216 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.
- Product
- ARForms
- Fixed in
- 7.0.2
- What to do
- Update ARForms to 7.0.2 or newer.
Nov 28, 2024SP Blog Designer: Path Traversal: '.../...//'CVE-2024-52498 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows PHP Local File Inclusion.This issue affects SP Blog Designer: from n/a through <= 1.0.0.
- Product
- SP Blog Designer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SP Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Jobify: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52481 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Astoundify Jobify jobify allows Relative Path Traversal.This issue affects Jobify: from n/a through < 4.3.0.
- Product
- Jobify
- Fixed in
- 4.2.4
- What to do
- Update Jobify to 4.2.4 or newer.
Nov 27, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Path TraversalCVE-2024-11219 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.0.6 via the get_image function. This makes it possible for unauthenticated attackers to view arbitrary images on the server, which can contain sensitive information.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 26, 2024Product Input Fields for WooCommerce: Directory TraversalCVE-2024-10857 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Product Input Fields for WooCommerce
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 23, 2024MP3 Sticky Player: Directory TraversalCVE-2024-10803 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Please note the vendor released the patched version as the same version as the affected version.
- Product
- MP3 Sticky Player
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update MP3 Sticky Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 20, 2024Bootscraper: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52449 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Navneil Naicer Bootscraper allows PHP Local File Inclusion.This issue affects Bootscraper: from n/a through 2.1.0.
- Product
- Bootscraper
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Bootscraper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Ultimate Classified Listings: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52448 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Contact Page With Google Map: Path Traversal: '.../...//'CVE-2024-52447 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Path Traversal: '.../...//' vulnerability in corporatezen222 Contact Page With Google Map contact-page-with-google-map allows Path Traversal.This issue affects Contact Page With Google Map: from n/a through <= 1.6.1.
- Product
- Contact Page With Google Map
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Contact Page With Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Opal Woo Custom Product Variation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52444 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through <= 1.1.3.
- Product
- Opal Woo Custom Product Variation
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Opal Woo Custom Product Variation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024CYAN Backup: Path Traversal: '.../...//'CVE-2024-52390 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through <= 2.5.3.
- Product
- CYAN Backup
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update CYAN Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 15, 2024PDF Generator Addon for Elementor Page Builder: Path TraversalCVE-2024-9935 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-24569 may be a duplicate of this issue.
- Product
- PDF Generator Addon for Elementor Page Builder
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update PDF Generator Addon for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 14, 2024WOLF: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52396 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue affects WOLF: from n/a through <= 1.0.8.3.
- Product
- WOLF
- Affected
- up to 1.0.8.3
- What to do
- Affects up to 1.0.8.3. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024DigiPass: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52378 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 DigiPass digipass allows Absolute Path Traversal.This issue affects DigiPass: from n/a through <= 0.3.0.
- Product
- DigiPass
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update DigiPass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Global Gateway e4 | Payeezy Gateway |: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52371 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway | globe-gateway-e4.This issue affects Global Gateway e4 | Payeezy Gateway |: from n/a through <= 2.0.
- Product
- Global Gateway e4 | Payeezy Gateway |
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Global Gateway e4 | Payeezy Gateway | to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2024LUNA RADIO PLAYER: Directory TraversalCVE-2024-10816 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.24.01.24 via the js/fallback.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- LUNA RADIO PLAYER
- Affected
- up to 6.24.01.24
- What to do
- Affects up to 6.24.01.24. Update LUNA RADIO PLAYER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordradioplayer.luna-universe.comwordfence.com
Nov 4, 2024WP Hotel Booking: Path Traversal: '.../...//'CVE-2024-51582 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: from n/a through <= 2.2.9.
- Product
- WP Hotel Booking
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newspack Blocks: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37423 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8.
- Product
- Newspack Blocks
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WishList Member X: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37108 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishList Member X allows Path Traversal.This issue affects WishList Member X: from n/a through 3.26.6.
- Product
- WishList Member X
- Affected
- up to 3.26.6
- What to do
- Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50509 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- Product
- Woocommerce Product Design
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50508 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- Product
- Woocommerce Product Design
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024The Pack Elementor addons: Relative Path TraversalCVE-2024-50453 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elementor addons: from n/a through <= 2.0.9.
- Product
- The Pack Elementor addons
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2024BuddyPress: Directory TraversalCVE-2024-10011 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions.
- Product
- BuddyPress
- Affected
- up to 14.1.0
- What to do
- Affects up to 14.1.0. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodex.buddypress.orggithub.com
Oct 20, 2024SSV Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49286 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV Events ssv-events allows PHP Local File Inclusion.This issue affects SSV Events: from n/a through <= 3.2.7.
- Product
- SSV Events
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update SSV Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024PDF-Rechnungsverwaltung: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49287 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in mh6webentwicklung PDF-Rechnungsverwaltung pdf-rechnungsverwaltung allows PHP Local File Inclusion.This issue affects PDF-Rechnungsverwaltung: from n/a through <= 0.0.1.
- Product
- PDF-Rechnungsverwaltung
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update PDF-Rechnungsverwaltung to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024SSV MailChimp: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49285 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV MailChimp ssv-mailchimp allows PHP Local File Inclusion.This issue affects SSV MailChimp: from n/a through <= 3.1.5.
- Product
- SSV MailChimp
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update SSV MailChimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.