Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

536 results · page 8 of 11

Dec 18, 2024Broken Link Checker | Finder: Blind Server-Side Request ForgeryCVE-2024-12121 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the 'moblc_check_link' function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Broken Link Checker | Finder
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Broken Link Checker | Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024WP All Import Pro: Server-Side Request ForgeryCVE-2024-9624 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance metadata.
Product
WP All Import Pro
Affected
up to 4.9.3
What to do
Affects up to 4.9.3. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Dec 16, 2024Radio Player: Server-Side Request Forgery (SSRF)CVE-2024-54385 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.83.
Product
Radio Player
Affected
up to 2.0.83
What to do
Affects up to 2.0.83. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Hurrakify: Server-Side Request Forgery (SSRF)CVE-2024-54330 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in hurraki Hurrakify hurrakify allows Server Side Request Forgery.This issue affects Hurrakify: from n/a through <= 2.4.
Product
Hurrakify
Affected
up to 2.4
What to do
Affects up to 2.4. Update Hurrakify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 11, 2024WP-Revive Adserver: Stored Cross-Site ScriptingCVE-2024-12461 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Revive Adserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprevive_async' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Revive Adserver
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update WP-Revive Adserver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 30, 2024Asset CleanUp: Page Speed Booster: Server-Side Request Forgery (SSRF)CVE-2024-53738 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through <= 1.3.9.8.
Product
Asset CleanUp: Page Speed Booster
Affected
up to 1.3.9.8
What to do
Affects up to 1.3.9.8. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 12, 2024RSS Feed Widget: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-9835 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
RSS Feed Widget
Fixed in
3.0.1
What to do
Update RSS Feed Widget to 3.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 9, 2024Responsive Filterable Portfolio: Server-Side Request Forgery (SSRF)CVE-2024-51785 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Nks Responsive Filterable Portfolio responsive-filterable-portfolio allows Server Side Request Forgery.This issue affects Responsive Filterable Portfolio: from n/a through <= 1.0.22.
Product
Responsive Filterable Portfolio
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update Responsive Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Code Embed: Server-Side Request ForgeryCVE-2024-10814 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the ce_get_file() function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Code Embed
Affected
up to 2.5
What to do
Affects up to 2.5. Update Code Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 4, 2024Magical Addons For Elementor: Server-Side Request Forgery (SSRF)CVE-2024-51665 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Server Side Request Forgery.This issue affects Magical Addons For Elementor: from n/a through <= 1.2.1.
Product
Magical Addons For Elementor
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Edwiser Bridge: Server-Side Request Forgery (SSRF)CVE-2024-49312 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge.This issue affects Edwiser Bridge: from n/a through <= 3.0.7.
Product
Edwiser Bridge
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively.CVE-2012-10018 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.
Affected
up to 6.1
What to do
Affects up to 6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 28, 2024GTM Server Side: Reflected Cross-Site ScriptingCVE-2024-8712 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GTM Server Side plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.19. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
GTM Server Side
Affected
up to 2.1.19
What to do
Affects up to 2.1.19. Update GTM Server Side to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2024Justified Image Grid: Server-Side Request Forgery (SSRF)CVE-2024-43989 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through <= 4.6.1.
Product
Justified Image Grid
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update Justified Image Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 12, 2024MM-Breaking News: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-8056 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
MM-Breaking News
Affected
up to 0.7.9
What to do
Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024Adicon Server: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-7766 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Adicon Server WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Adicon Server
Affected
up to 1.2
What to do
Affects up to 1.2. Update Adicon Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024Music Request Manager: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6018 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
Music Request Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 17, 2024Skitter Slideshow: Server-Side Request ForgeryCVE-2022-1751 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Skitter Slideshow plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the /image.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Skitter Slideshow
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Skitter Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org securityforeveryone.com
Aug 7, 2024Modern Events Calendar: Server-Side Request ForgeryCVE-2024-6522 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Modern Events Calendar
Affected
up to 7.12.1
What to do
Affects up to 7.12.1. Update Modern Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mec.webnus.net plugins.trac.wordpress.org
Aug 1, 2024Edubin: Server-Side Request Forgery (SSRF)CVE-2024-39637 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in pixelcurve Edubin edubin.This issue affects Edubin: from n/a through <= 9.2.0.
Product
Edubin
Affected
up to 9.2.0
What to do
Affects up to 9.2.0. Update Edubin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024AI Engine: ChatGPT Chatbot: Server-Side Request Forgery (SSRF)CVE-2024-38791 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.
Product
AI Engine: ChatGPT Chatbot
Affected
up to 2.4.7
What to do
Affects up to 2.4.7. Update AI Engine: ChatGPT Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 1, 2024Remote Content Shortcode: Server-Side Request ForgeryCVE-2024-2090 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remote_content shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Remote Content Shortcode
Affected
up to 1.5
What to do
Affects up to 1.5. Update Remote Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 22, 2024Magical Addons For Elementor: Server-Side Request Forgery (SSRF)CVE-2024-38730 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Noor alam Magical Addons For Elementor.This issue affects Magical Addons For Elementor: from n/a through 1.1.41.
Product
Magical Addons For Elementor
Affected
up to 1.1.41
What to do
Affects up to 1.1.41. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024Seraphinite Post .DOCX Source: Server-Side Request Forgery (SSRF)CVE-2024-38728 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source.This issue affects Seraphinite Post .DOCX Source: from n/a through 2.16.9.
Product
Seraphinite Post .DOCX Source
Affected
up to 2.16.9
What to do
Affects up to 2.16.9. Update Seraphinite Post .DOCX Source to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024JSON Content Importer: Server-Side Request Forgery (SSRF)CVE-2024-38723 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Bernhard Kux JSON Content Importer.This issue affects JSON Content Importer: from n/a through 1.5.6.
Product
JSON Content Importer
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update JSON Content Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 22, 2024BerqWP: Server-Side Request Forgery (SSRF)CVE-2024-37942 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in Berqier Ltd BerqWP.This issue affects BerqWP: from n/a through 1.7.5.
Product
BerqWP
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update BerqWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024WappPress: Server-Side Request Forgery (SSRF)CVE-2024-38758 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 6.0.4.
Product
WappPress
Affected
up to 6.0.4
What to do
Affects up to 6.0.4. Update WappPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 15, 2024wp-cart-for-digital-products: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6072 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
wp-cart-for-digital-products
Fixed in
8.5.5
What to do
Update wp-cart-for-digital-products to 8.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024wp-eMember: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-5744 · WordPress plugins & themes · reported by WPScanMedium 6.8
The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
wp-eMember
Fixed in
10.6.7
What to do
Update wp-eMember to 10.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024If-So Dynamic Content Personalization: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-5713 · WordPress plugins & themes · reported by WPScanMedium 5.4
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
If-So Dynamic Content Personalization
Fixed in
1.8.0.4
What to do
Update If-So Dynamic Content Personalization to 1.8.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 6, 2024Foxiz: Server-Side Request Forgery (SSRF)CVE-2024-37260 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in Theme-Ruby Foxiz.This issue affects Foxiz: from n/a through 2.3.5.
Product
Foxiz
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Foxiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 6, 2024WP Scraper: Server-Side Request Forgery (SSRF)CVE-2024-37208 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Robert Macchi WP Scraper.This issue affects WP Scraper: from n/a through 5.7.
Product
WP Scraper
Affected
up to 5.7
What to do
Affects up to 5.7. Update WP Scraper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 26, 2024BlossomThemes Email Newsletter: Server-Side Request Forgery (SSRF)CVE-2024-37098 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Blossom Themes BlossomThemes Email Newsletter.This issue affects BlossomThemes Email Newsletter: from n/a through 2.2.6.
Product
BlossomThemes Email Newsletter
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update BlossomThemes Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024WordPress Picture / Portfolio / Media Gallery: Server-Side Request ForgeryCVE-2024-5021 · WordPress plugins & themes · reported by WordfenceCritical 9.3
The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.1 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
WordPress Picture / Portfolio / Media Gallery
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update WordPress Picture / Portfolio / Media Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 14, 2024ElementsKit PRO: Server-Side Request ForgeryCVE-2024-4404 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. This can allow authenticated attackers, with contributor-level permissions and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
ElementsKit PRO
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update ElementsKit PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmet.com wordfence.com
Jun 7, 2024TablePress – Tables in WordPress made easy: Server-Side Request ForgeryCVE-2024-4354 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3 via the get_files_to_import() function. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Due to the complex nature of protecting against DNS rebind attacks in WordPress software, we settled on the developer simply restricting the usage of the URL import functionality to just administrators. While this is not optimal, we feel this poses a minimal risk to most site owners and ideally WordPress core would correct this issue in wp_safe_remote_get() and other functions.
Product
TablePress – Tables in WordPress made easy
Affected
up to 2.3
What to do
Affects up to 2.3. Update TablePress – Tables in WordPress made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 3, 2024Ninja Tables: Server-Side Request Forgery (SSRF)CVE-2024-35635 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9.
Product
Ninja Tables
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Blocksy Companion: Server-Side Request Forgery (SSRF)CVE-2024-35633 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Creative Themes Blocksy Companion blocksy-companion.This issue affects Blocksy Companion: from n/a through <= 2.0.42.
Product
Blocksy Companion
Affected
up to 2.0.42
What to do
Affects up to 2.0.42. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Church Admin: Server-Side Request Forgery (SSRF)CVE-2024-35637 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6.
Product
Church Admin
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 31, 2024Auto Featured Image (Auto Post Thumbnail): Server-Side Request ForgeryCVE-2023-7073 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library AJAX action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Auto Featured Image (Auto Post Thumbnail)
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2024This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the serverCVE-2024-4388 · WordPress plugins & themes · reported by WPScanHigh 7.5
This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
May 22, 2024WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation: Server-Side Request ForgeryCVE-2024-1855 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.23 via the wpc_check_for_submission function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application.
Product
WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation
Affected
up to 2.2.23
What to do
Affects up to 2.2.23. Update WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024Memberpress: Blind Server-Side Request ForgeryCVE-2024-5031 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Memberpress
Affected
up to 1.11.29
What to do
Affects up to 1.11.29. Update Memberpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record memberpress.com wordfence.com
May 17, 2024Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() functionCVE-2024-4789 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected
up to 3.1.72
What to do
Affects up to 3.1.72. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record stylemixthemes.com wordfence.com
May 17, 2024Wp Ultimate Review: Client-Side Enforcement of Server-Side SecurityCVE-2024-32685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
Product
Wp Ultimate Review
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Zero Spam: Client-Side Enforcement of Server-Side SecurityCVE-2024-32521 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zero Spam: from n/a through 5.5.6.
Product
Zero Spam
Affected
up to 5.5.6
What to do
Affects up to 5.5.6. Update Zero Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024weForms: Client-Side Enforcement of Server-Side SecurityCVE-2024-32512 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20.
Product
weForms
Affected
up to 1.6.20
What to do
Affects up to 1.6.20. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024ICS Calendar: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF)CVE-2023-46784 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF) vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Absolute Path Traversal, : Server Side Request Forgery.This issue affects ICS Calendar: from n/a through 10.12.0.3.
Product
ICS Calendar
Affected
up to 10.12.0.3
What to do
Affects up to 10.12.0.3. Update ICS Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024ShortPixel Adaptive Images: Server-Side Request Forgery (SSRF)CVE-2024-35172 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.
Product
ShortPixel Adaptive Images
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Starter Templates — Elementor, WordPress & Beaver Builder Templates: Server-Side Request ForgeryCVE-2024-1467 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Starter Templates — Elementor, WordPress & Beaver Builder Templates
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update Starter Templates — Elementor, WordPress & Beaver Builder Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.