Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
668 results · page 9 of 14
Feb 20, 2025Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported): Unauthorized modification of data|loss of dataCVE-2024-13520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.9. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher.
- Product
- Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
- Affected
- up to 4.4.9
- What to do
- Affects up to 4.4.9. Update Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 18, 2025Super Testimonials: Stored Cross-Site ScriptingCVE-2024-13704 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Super Testimonials
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 13, 2025JS Help Desk – The Ultimate Help Desk & Support: Sensitive Information ExposureCVE-2024-13606 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.
- Product
- JS Help Desk – The Ultimate Help Desk & Support
- Affected
- up to 2.8.8
- What to do
- Affects up to 2.8.8. Update JS Help Desk – The Ultimate Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 12, 2025Majestic Support – The Leading-Edge Help Desk & Customer Support: Insecure Direct Object ReferenceCVE-2024-13601 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export ticket data for any user.
- Product
- Majestic Support – The Leading-Edge Help Desk & Customer Support
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Majestic Support – The Leading-Edge Help Desk & Customer Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2025Majestic Support – The Leading-Edge Help Desk & Customer Support: Sensitive Information ExposureCVE-2024-13600 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the 'majesticsupportdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/majesticsupportdata directory which can contain file attachments included in support tickets.
- Product
- Majestic Support – The Leading-Edge Help Desk & Customer Support
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Majestic Support – The Leading-Edge Help Desk & Customer Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 11, 2025SuperSaaS – online appointment scheduling: Stored Cross-Site ScriptingCVE-2025-0862 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is limited to Chromium-based browsers (e.g. Chrome, Edge, Brave).
- Product
- SuperSaaS – online appointment scheduling
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update SuperSaaS – online appointment scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 9, 2025Super Store Finder: SQL InjectionCVE-2024-13440 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all versions up to, and including, 7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into an already existing query to store cross-site scripting in store reviews.
- Product
- Super Store Finder
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsuperstorefinder.networdfence.com
Feb 4, 2025JS Help Desk – The Ultimate Help Desk & Support: Insecure Direct Object ReferenceCVE-2024-13607 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level permissions and above, to export ticket data for any user.
- Product
- JS Help Desk – The Ultimate Help Desk & Support
- Affected
- up to 2.8.8
- What to do
- Affects up to 2.8.8. Update JS Help Desk – The Ultimate Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2025Nirweb support: Authorization Bypass Through User-Controlled KeyCVE-2025-22695 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support nirweb-support.This issue affects Nirweb support: from n/a through <= 3.0.3.
- Product
- Nirweb support
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Nirweb support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2025WooCommerce Support Ticket System: Unauthorized access and loss of dataCVE-2024-13775 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list' functions in all versions up to, and including, 17.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts, and read names, emails, and capabilities of all users.
- Product
- WooCommerce Support Ticket System
- Affected
- up to 17.8
- What to do
- Affects up to 17.8. Update WooCommerce Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jan 27, 2025KB Support: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24741 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in LOGON KB Support kb-support.This issue affects KB Support: from n/a through <= 1.6.7.
- Product
- KB Support
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update KB Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Super Block Slider: Missing AuthorizationCVE-2025-24682 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Michael Super Block Slider super-block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Block Slider: from n/a through <= 2.7.9.
- Product
- Super Block Slider
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update Super Block Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-24591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.
- Product
- GDPR CCPA Compliance Support
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Social Share, Social Login and Social Comments Plugin – Super Socializer: Limited SQL InjectionCVE-2024-13230 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional values into the already existing query that can be used to extract user metadata from the database.
- Product
- Social Share, Social Login and Social Comments Plugin – Super Socializer
- Affected
- up to 7.14
- What to do
- Affects up to 7.14. Update Social Share, Social Login and Social Comments Plugin – Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 15, 2025WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22762 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Stored XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.
- Product
- WordPress HelpDesk & Support Ticket System Plugin – Octrace Support
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WordPress HelpDesk & Support Ticket System Plugin – Octrace Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025MindValley Super PageMash: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22502 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mindvalley MindValley Super PageMash mindvalley-pagemash allows SQL Injection.This issue affects MindValley Super PageMash: from n/a through <= 1.1.
- Product
- MindValley Super PageMash
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MindValley Super PageMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Hive Support: Missing AuthorizationCVE-2025-22298 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hive Support: from n/a through <= 1.1.6.
- Product
- Hive Support
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode: Stored Cross-Site ScriptingCVE-2024-12457 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vchat' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2025Data Tables Generator by Supsystic: Missing AuthorizationCVE-2024-56253 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in supsystic Data Tables Generator by Supsystic data-tables-generator-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Data Tables Generator by Supsystic: from n/a through <= 1.10.36.
- Product
- Data Tables Generator by Supsystic
- Affected
- up to 1.10.36
- What to do
- Affects up to 1.10.36. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Smartsupp – live chat, chatbots, AI and lead generation: Cross-Site Request Forgery (CSRF)CVE-2024-38790 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Smartsupp Smartsupp – live chat, chatbots, AI and lead generation smartsupp-live-chat allows Cross Site Request Forgery.This issue affects Smartsupp – live chat, chatbots, AI and lead generation: from n/a through <= 3.6.
- Product
- Smartsupp – live chat, chatbots, AI and lead generation
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update Smartsupp – live chat, chatbots, AI and lead generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025WP SuperBackup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Reflected XSS.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56070 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Deserialization of Untrusted DataCVE-2024-56068 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Missing AuthorizationCVE-2024-56067 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Unrestricted Upload of File with Dangerous TypeCVE-2024-56064 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024YDS Support Ticket System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55985 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ydesignservices YDS Support Ticket System yds-support-ticket-system allows SQL Injection.This issue affects YDS Support Ticket System: from n/a through <= 1.0.
- Product
- YDS Support Ticket System
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update YDS Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Hive Support: Cross-Site Request Forgery (CSRF)CVE-2024-54321 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hive Support Hive Support hive-support allows Cross Site Request Forgery.This issue affects Hive Support: from n/a through <= 1.1.2.
- Product
- Hive Support
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Hive Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54304 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hive Support Hive Support hive-support allows SQL Injection.This issue affects Hive Support: from n/a through <= 1.1.2.
- Product
- Hive Support
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Awesome Support: Missing AuthorizationCVE-2024-54289 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.3.1.
- Product
- Awesome Support
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54274 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Reflected XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.
- Product
- WordPress HelpDesk & Support Ticket System Plugin – Octrace Support
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WordPress HelpDesk & Support Ticket System Plugin – Octrace Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Super Socializer: Missing AuthorizationCVE-2023-41802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Team Heateor Super Socializer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Socializer: from n/a through 7.13.54.
- Product
- Super Socializer
- Affected
- up to 7.13.54
- What to do
- Affects up to 7.13.54. Update Super Socializer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Woocommerce Support System: Cross-Site Request Forgery (CSRF)CVE-2023-41686 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in ilGhera Woocommerce Support System allows Cross Site Request Forgery.This issue affects Woocommerce Support System: from n/a through 1.2.2.
- Product
- Woocommerce Support System
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Woocommerce Support System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Popup by Supsystic: Missing AuthorizationCVE-2023-39997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.19
- What to do
- Affects up to 1.10.19. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2022-46840 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
- Product
- JS Help Desk – Best Help Desk & Support
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024JS Help Desk – Best Help Desk & Support: Missing AuthorizationCVE-2022-46838 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
- Product
- JS Help Desk – Best Help Desk & Support
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Super Backup & Clone - Migrate for: Arbitrary file uploadsCVE-2024-9290 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Super Backup & Clone - Migrate for
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Super Backup & Clone - Migrate for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Dec 9, 2024Popup by Supsystic: Missing AuthorizationCVE-2023-51353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through <= 1.10.19.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.19
- What to do
- Affects up to 1.10.19. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Awesome Support: Missing AuthorizationCVE-2023-49857 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.7.
- Product
- Awesome Support
- Affected
- up to 6.1.7
- What to do
- Affects up to 6.1.7. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Awesome Support: Missing AuthorizationCVE-2023-49757 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.10.
- Product
- Awesome Support
- Affected
- up to 6.1.10
- What to do
- Affects up to 6.1.10. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Awesome Support: Missing AuthorizationCVE-2023-48324 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.4.
- Product
- Awesome Support
- Affected
- up to 6.1.4
- What to do
- Affects up to 6.1.4. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Super Progressive Web Apps: Missing AuthorizationCVE-2023-48277 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SuperPWA Super Progressive Web Apps super-progressive-web-apps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Progressive Web Apps: from n/a through <= 2.2.21.
- Product
- Super Progressive Web Apps
- Affected
- up to 2.2.21
- What to do
- Affects up to 2.2.21. Update Super Progressive Web Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Zendesk Support for: Missing AuthorizationCVE-2023-23716 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zendesk Zendesk Support for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zendesk Support for WordPress: from n/a through 1.8.4.
- Product
- Zendesk Support for
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Zendesk Support for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 26, 2024Support SVG – Upload svg files in wordpress without hassle: Stored Cross-Site ScriptingCVE-2024-11091 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Support SVG – Upload svg files in wordpress without hassle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Support SVG – Upload svg files in wordpress without hassle
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Support SVG – Upload svg files in wordpress without hassle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 18, 2024Popup by Supsystic: Deserialization of Untrusted DataCVE-2024-52434 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsystic: from n/a through <= 1.10.29.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.29
- What to do
- Affects up to 1.10.29. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Hive Support: Unrestricted Upload of File with Dangerous TypeCVE-2024-52370 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Hive Support Hive Support hive-support allows Upload a Web Shell to a Web Server.This issue affects Hive Support: from n/a through <= 1.1.1.
- Product
- Hive Support
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Super Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51588 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in riponhossain Super Addons for Elementor super-addons-for-elementor allows DOM-Based XSS.This issue affects Super Addons for Elementor: from n/a through <= 1.0.
- Product
- Super Addons for Elementor
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Super Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2024WooCommerce Support Ticket System: Arbitrary file uploadsCVE-2024-10627 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WooCommerce Support Ticket System
- Affected
- up to 17.7
- What to do
- Affects up to 17.7. Update WooCommerce Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 8, 2024WooCommerce Support Ticket System: Arbitrary file deletionCVE-2024-10626 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- WooCommerce Support Ticket System
- Affected
- up to 17.7
- What to do
- Affects up to 17.7. Update WooCommerce Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 8, 2024WooCommerce Support Ticket System: Arbitrary file deletionCVE-2024-10625 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- WooCommerce Support Ticket System
- Affected
- up to 17.7
- What to do
- Affects up to 17.7. Update WooCommerce Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 8, 2024Easy SVG Support: Stored Cross-Site ScriptingCVE-2024-10269 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Easy SVG Support
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Easy SVG Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.