Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

984 results · page 9 of 20

Dec 10, 2024LearnPress – WordPress LMS: Sensitive Information ExposureCVE-2024-11868 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. This makes it possible for unauthenticated attackers to extract potentially sensitive paid course material.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.7.3
What to do
Affects up to 4.2.7.3. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record abrahack.com plugins.trac.wordpress.org
Dec 9, 2024SearchIQ: Missing AuthorizationCVE-2023-47832 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SearchIQ SearchIQ searchiq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SearchIQ: from n/a through <= 4.4.
Product
SearchIQ
Affected
up to 4.4
What to do
Affects up to 4.4. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Smart WooCommerce Search: Missing AuthorizationCVE-2023-30783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0.
Product
Smart WooCommerce Search
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Smart WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2024CLUEVO LMS, E-Learning Platform: Cross-Site Request ForgeryCVE-2024-11444 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.13.2. This is due to missing or incorrect nonce validation on the cluevo_render_module_ui() function. This makes it possible for unauthenticated attackers to delete modules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CLUEVO LMS, E-Learning Platform
Affected
up to 1.13.2
What to do
Affects up to 1.13.2. Update CLUEVO LMS, E-Learning Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 3, 2024SearchIQ – The Search Solution: Stored Cross-Site ScriptingCVE-2024-10885 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SearchIQ – The Search Solution
Affected
up to 4.6
What to do
Affects up to 4.6. Update SearchIQ – The Search Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 30, 2024WP Find Your Nearest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53757 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest allows Stored XSS.This issue affects WP Find Your Nearest: from n/a through <= 0.3.1.
Product
WP Find Your Nearest
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update WP Find Your Nearest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 28, 2024JobSearch WP Job Board: Privilege escalationCVE-2024-11925 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.7. This is due to the plugin not properly verifying a users identity when verifying an email address through the user_account_activation function. This makes it possible for unauthenticated attackers to log in as any user, including site administrators if the users email is known.
Product
JobSearch WP Job Board
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 20, 2024Quick Learn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2024-52441 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Rajesh Thanoch Quick Learn quick-learn allows Object Injection.This issue affects Quick Learn: from n/a through <= 1.0.1.
Product
Quick Learn
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Quick Learn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Posts Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama Posts Search posts-search allows Stored XSS.This issue affects Posts Search: from n/a through <= 1.2.2.
Product
Posts Search
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Posts Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Utech Spinning Earth: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51839 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech Spinning Earth utech-spinning-earth allows DOM-Based XSS.This issue affects Utech Spinning Earth: from n/a through <= 1.2.
Product
Utech Spinning Earth
Affected
up to 1.2
What to do
Affects up to 1.2. Update Utech Spinning Earth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024Linear: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52426 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linear Oy Linear linear allows DOM-Based XSS.This issue affects Linear: from n/a through <= 2.8.0.
Product
Linear
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Linear to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 15, 2024Simple Local Avatars: Unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache functionCVE-2024-10786 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear user caches.
Product
Simple Local Avatars
Affected
up to 2.7.11
What to do
Affects up to 2.7.11. Update Simple Local Avatars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 15, 2024LearnPress Export Import – WordPress extension for LearnPress: Reflected Cross-Site ScriptingCVE-2024-9609 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
LearnPress Export Import – WordPress extension for LearnPress
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update LearnPress Export Import – WordPress extension for LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 9, 2024Search order by product SKU for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51693 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in labdav Search order by product SKU for WooCommerce search-order-by-product-sku-for-woocommerce allows Reflected XSS.This issue affects Search order by product SKU for WooCommerce: from n/a through <= 0.2.
Product
Search order by product SKU for WooCommerce
Affected
up to 0.2
What to do
Affects up to 0.2. Update Search order by product SKU for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Bing Search API Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51692 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in askewbrook Bing Search API Integration abbs-bing-search allows Reflected XSS.This issue affects Bing Search API Integration: from n/a through <= 0.3.3.
Product
Bing Search API Integration
Affected
up to 0.3.3
What to do
Affects up to 0.3.3. Update Bing Search API Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Twitter real time search scrolling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51716 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Twitter real time search scrolling twitter-real-time-search-scrolling allows Reflected XSS.This issue affects Twitter real time search scrolling: from n/a through <= 7.0.
Product
Twitter real time search scrolling
Affected
up to 7.0
What to do
Affects up to 7.0. Update Twitter real time search scrolling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024WPLMS Learning Management System for WordPress, WordPress LMS: Arbitrary file read and deletionCVE-2024-10470 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.
Product
WPLMS Learning Management System for WordPress, WordPress LMS
Affected
up to 4.962
What to do
Affects up to 4.962. Update WPLMS Learning Management System for WordPress, WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 6, 2024JobSearch WP Job Board: Arbitrary file uploadsCVE-2024-8615 · WordPress plugins & themes · reported by WordfenceCritical 10
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_excel_file_callback() function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
JobSearch WP Job Board
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 6, 2024JobSearch WP Job Board: Arbitrary file uploadsCVE-2024-8614 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload() function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
JobSearch WP Job Board
Affected
up to 2.6.7
What to do
Affects up to 2.6.7. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 1, 2024JobSearch: Missing AuthorizationCVE-2024-43929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eyecix JobSearch allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JobSearch: from n/a through 2.5.4.
Product
JobSearch
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024JobSearch: Missing AuthorizationCVE-2024-43928 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in eyecix JobSearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through 2.5.4.
Product
JobSearch
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Clearfy Cache: Missing AuthorizationCVE-2024-43260 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Creative Motion Clearfy Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clearfy Cache: from n/a through 2.2.4.
Product
Clearfy Cache
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Clearfy Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WP Search Analytics: Missing AuthorizationCVE-2024-43229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Cornel Raiu WP Search Analytics search-analytics.This issue affects WP Search Analytics: from n/a through <= 1.4.9.
Product
WP Search Analytics
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update WP Search Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WP Fast Total Search: Missing AuthorizationCVE-2024-38714 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.68.232.
Product
WP Fast Total Search
Affected
up to 1.68.232
What to do
Affects up to 1.68.232. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Uncanny Toolkit Pro for LearnDash: Missing AuthorizationCVE-2024-37439 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a through 4.1.4.0
Product
Uncanny Toolkit Pro for LearnDash
What to do
Update Uncanny Toolkit Pro for LearnDash to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 31, 2024JobSearch: Cross-Site Request Forgery (CSRF)CVE-2024-43930 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in eyecix JobSearch allows Cross Site Request Forgery.This issue affects JobSearch: from n/a through 2.5.3.
Product
JobSearch
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Masteriyo LMS – eLearning and Online Course Builder for: Unauthorized user profile modificationCVE-2024-10008 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.
Product
Masteriyo LMS – eLearning and Online Course Builder for
Affected
up to 1.13.3
What to do
Affects up to 1.13.3. Update Masteriyo LMS – eLearning and Online Course Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 29, 2024Masteriyo LMS – eLearning and Online Course Builder for: Stored Cross-Site ScriptingCVE-2024-10000 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with student-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Masteriyo LMS – eLearning and Online Course Builder for
Affected
up to 1.13.3
What to do
Affects up to 1.13.3. Update Masteriyo LMS – eLearning and Online Course Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2024PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip: Reflected Cross-Site ScriptingCVE-2024-8717 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pdf_source' parameter in all versions up to, and including, 2.3.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip
Affected
up to 2.3.32
What to do
Affects up to 2.3.32. Update PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2024AB Categories Search Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49240 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajberasategui AB Categories Search Widget ab-categories-search-widget allows Reflected XSS.This issue affects AB Categories Search Widget : from n/a through <= 0.2.5.
Product
AB Categories Search Widget
Affected
up to 0.2.5
What to do
Affects up to 0.2.5. Update AB Categories Search Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024ADIF Log Search Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emka73 ADIF Log Search Widget adif-log-search-widget allows Reflected XSS.This issue affects ADIF Log Search Widget: from n/a through <= 1.0f.
Product
ADIF Log Search Widget
Affected
up to 1.0f
What to do
Affects up to 1.0f. Update ADIF Log Search Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024ACF Images Search And Insert: Unrestricted Upload of File with Dangerous TypeCVE-2024-48035 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in takayukii ACF Images Search And Insert acf-images-search-and-insert allows Upload a Web Shell to a Web Server.This issue affects ACF Images Search And Insert: from n/a through <= 1.1.4.
Product
ACF Images Search And Insert
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update ACF Images Search And Insert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2024The AADMY – Add Auto Date Month Year Into Posts: Arbitrary shortcode executionCVE-2024-9837 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The AADMY – Add Auto Date Month Year Into Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The AADMY – Add Auto Date Month Year Into Posts
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update The AADMY – Add Auto Date Month Year Into Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2024JobSearch: Deserialization of Untrusted DataCVE-2024-47636 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5.9.
Product
JobSearch
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2024WP-Advanced-Search: Does not sanitize and escape the t parameter before using it in a SQL statementCVE-2024-9796 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Product
WP-Advanced-Search
Fixed in
3.3.9.2
What to do
Update WP-Advanced-Search to 3.3.9.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 6, 2024YITH WooCommerce Ajax Search: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47350 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-ajax-search.This issue affects YITH WooCommerce Ajax Search: from n/a through <= 2.8.0.
Product
YITH WooCommerce Ajax Search
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update YITH WooCommerce Ajax Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024JobSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47394 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through <= 2.5.9.
Product
JobSearch
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Search Atlas SEO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47387 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 1.8.2.
Product
Search Atlas SEO
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Search Atlas SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2024WP Search Analytics: Reflected Cross-Site ScriptingCVE-2024-9209 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Search Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Search Analytics
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update WP Search Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2024Uncanny Groups for LearnDash: User group addCVE-2024-8350 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group leader-level access and above, to add users to their group which ultimately allows them to leverage CVE-2024-8349 and gain admin access to the site.
Product
Uncanny Groups for LearnDash
Affected
up to 6.1.0.1
What to do
Affects up to 6.1.0.1. Update Uncanny Groups for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Sep 24, 2024Uncanny Groups for LearnDash: Privilege escalationCVE-2024-8349 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access.
Product
Uncanny Groups for LearnDash
Affected
up to 6.1.0.1
What to do
Affects up to 6.1.0.1. Update Uncanny Groups for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Sep 23, 2024YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes.CVE-2024-7846 · WordPress plugins & themes · reported by WPScanMedium 5.4
YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.
Fixed in
2.7.1
What to do
Update the plugin to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2024WP Custom Fields Search: Stored Cross-Site ScriptingCVE-2024-8364 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all versions up to, and including, 1.2.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Custom Fields Search
Affected
up to 1.2.35
What to do
Affects up to 1.2.35. Update WP Custom Fields Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 17, 2024Enhanced Search Box: Does not have CSRF check in placeCVE-2024-8091 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Enhanced Search Box
Affected
up to 0.6.1
What to do
Affects up to 0.6.1. Update Enhanced Search Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024LearnPress – WordPress LMS: SQL InjectionCVE-2024-8529 · WordPress plugins & themes · reported by WordfenceCritical 10
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.7
What to do
Affects up to 4.2.7. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record abrahack.com plugins.trac.wordpress.org
Sep 12, 2024LearnPress – WordPress LMS: SQL InjectionCVE-2024-8522 · WordPress plugins & themes · reported by WordfenceCritical 10
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.7
What to do
Affects up to 4.2.7. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record abrahack.com plugins.trac.wordpress.org
Sep 6, 2024LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Blind SQL InjectionCVE-2024-7349 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Affected
up to 7.7.5
What to do
Affects up to 7.7.5. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 5, 2024Ivory Search – WordPress Search: Information ExposureCVE-2024-6835 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.5.6 via the ajax_load_posts function. This makes it possible for unauthenticated attackers to extract text data from password-protected posts using the boolean-based attack on the AJAX search form
Product
Ivory Search – WordPress Search
Affected
up to 5.5.6
What to do
Affects up to 5.5.6. Update Ivory Search – WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2024Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier.CVE-2024-45429 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting privilege which is set in the product settings stores an arbitrary script in the field label, the script may be executed on the web browser of the logged-in user with the same privilege as the attacker's.
Affected
up to 6.3.5
What to do
Affects up to 6.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Aug 29, 2024JobSearch: Deserialization of Untrusted DataCVE-2024-43931 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3.
Product
JobSearch
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.