Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

574 results · page 9 of 12

Mar 26, 2024Widgets for Google Reviews: Unrestricted Upload of File with Dangerous TypeCVE-2023-48275 · WordPress plugins & themes · reported by PatchstackHigh 8
Unrestricted Upload of File with Dangerous Type vulnerability in Trustindex.Io Widgets for Google Reviews.This issue affects Widgets for Google Reviews: from n/a through 11.0.2.
Product
Widgets for Google Reviews
Affected
up to 11.0.2
What to do
Affects up to 11.0.2. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2024LiquidPoll – Polls, Surveys, NPS and Feedback Reviews: Sensitive Information ExposureCVE-2024-2080 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.76 via the poller_list shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to extract information from polls that may be private.
Product
LiquidPoll – Polls, Surveys, NPS and Feedback Reviews
Affected
up to 3.3.76
What to do
Affects up to 3.3.76. Update LiquidPoll – Polls, Surveys, NPS and Feedback Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 19, 2024Builder for WooCommerce reviews shortcodes – ReviewShort: Cross-Site Request Forgery (CSRF)CVE-2024-29093 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through <= 1.01.3.
Product
Builder for WooCommerce reviews shortcodes – ReviewShort
Affected
up to 1.01.3
What to do
Affects up to 1.01.3. Update Builder for WooCommerce reviews shortcodes – ReviewShort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Site Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29095 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews.This issue affects Site Reviews: from n/a through <= 6.11.6.
Product
Site Reviews
Affected
up to 6.11.6
What to do
Affects up to 6.11.6. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2024Error Log Viewer by BestWebSoft: Is affected by a Directory Listing issueCVE-2023-6821 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and download PHP logs without authorization
Product
Error Log Viewer by BestWebSoft
Fixed in
1.1.3
What to do
Update Error Log Viewer by BestWebSoft to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 15, 2024Ultimate Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This issue affects Ultimate Reviews: from n/a through 3.2.8.
Product
Ultimate Reviews
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Ultimate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Site Reviews: Stored Cross-Site ScriptingCVE-2024-2293 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Site Reviews
Affected
up to 6.11.4
What to do
Affects up to 6.11.4. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024TNC PDF viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25097 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issue affects TNC PDF viewer: from n/a through 2.8.0.
Product
TNC PDF viewer
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update TNC PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Customer Reviews for WooCommerce: Unauthorized modification of dataCVE-2024-1044 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to, and including, 5.38.12. This makes it possible for unauthenticated attackers to submit reviews with arbitrary email addresses regardless of whether reviews are globally enabled.
Product
Customer Reviews for WooCommerce
Affected
up to 5.38.12
What to do
Affects up to 5.38.12. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Customer Reviews for WooCommerce: Missing AuthorizationCVE-2023-51692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.This issue affects Customer Reviews for WooCommerce: from n/a through 5.38.1.
Product
Customer Reviews for WooCommerce
Affected
up to 5.38.1
What to do
Affects up to 5.38.1. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Basic Log Viewer: Cross-Site Request Forgery (CSRF)CVE-2024-24935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4.
Product
Basic Log Viewer
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Basic Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024ERE Recently Viewed – Essential Real Estate Add-On: Deserialization of Untrusted DataCVE-2024-24797 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in G5Theme ERE Recently Viewed – Essential Real Estate Add-On.This issue affects ERE Recently Viewed – Essential Real Estate Add-On: from n/a through 1.3.
Product
ERE Recently Viewed – Essential Real Estate Add-On
Affected
up to 1.3
What to do
Affects up to 1.3. Update ERE Recently Viewed – Essential Real Estate Add-On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Content Views – Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode): Stored Cross-Site ScriptingCVE-2024-0612 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Content Views – Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Content Views – Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode)
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Content Views – Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Cross-Site Request ForgeryCVE-2024-0374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'create_view' function. This makes it possible for unauthenticated attackers to create views via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Cross-Site Request ForgeryCVE-2024-0373 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'save_view' function. This makes it possible for unauthenticated attackers to modify arbitrary post titles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized access of dataCVE-2024-0372 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_form_fields' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to create form views.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized modification of dataCVE-2024-0371 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'create_view' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to create form views.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized modification of dataCVE-2024-0370 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_view' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to modify the titles of arbitrary posts.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Five Star Restaurant Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24838 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Five Star Plugins Five Star Restaurant Reviews allows Stored XSS.This issue affects Five Star Restaurant Reviews: from n/a through 2.3.5.
Product
Five Star Restaurant Reviews
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Five Star Restaurant Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024WP Review Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51685 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LJ Apps WP Review Slider allows Stored XSS.This issue affects WP Review Slider: from n/a through 12.7.
Product
WP Review Slider
Affected
up to 12.7
What to do
Affects up to 12.7. Update WP Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Post views Stats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberNetikz Post views Stats post-views-stats allows DOM-Based XSS.This issue affects Post views Stats: from n/a through <= 1.4.1.
Product
Post views Stats
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Post views Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024PDF Viewer & 3D PDF Flipbook – DearPDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-23505 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive PDF Viewer & 3D PDF Flipbook – DearPDF allows Stored XSS.This issue affects PDF Viewer & 3D PDF Flipbook – DearPDF: from n/a through 2.0.38.
Product
PDF Viewer & 3D PDF Flipbook – DearPDF
Affected
up to 2.0.38
What to do
Affects up to 2.0.38. Update PDF Viewer & 3D PDF Flipbook – DearPDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WordPress Review & Structure Data Schema Plugin – Review Schema: Unauthorized modification of dataCVE-2024-0836 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrs_review_edit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.
Product
WordPress Review & Structure Data Schema Plugin – Review Schema
Affected
up to 2.1.14
What to do
Affects up to 2.1.14. Update WordPress Review & Structure Data Schema Plugin – Review Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2024the 'id' parameter in the 'get_view' function: The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injectionCVE-2024-1061 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.6
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.
Product
the 'id' parameter in the 'get_view' function
Fixed in
2.5.25
What to do
Update the 'id' parameter in the 'get_view' function to 2.5.25 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Jan 22, 2024WP Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6456 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Review Slider
Fixed in
13.0
What to do
Update WP Review Slider to 13.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Customer Reviews for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0079 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Customer Reviews for WooCommerce
Fixed in
5.17.0
What to do
Update Customer Reviews for WooCommerce to 5.17.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Dokan: Allows vendors to inject arbitrary javascript in product reviewsCVE-2022-3194 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.
Product
Dokan
Fixed in
3.6.4
What to do
Update Dokan to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 11, 2024Customer Reviews for WooCommerce: Arbitrary file uploadsCVE-2023-6979 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to, and including, 5.38.9. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Customer Reviews for WooCommerce
Affected
up to 5.38.9
What to do
Affects up to 5.38.9. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record drive.proton.me plugins.trac.wordpress.org
Jan 8, 2024Rate Star Review – AJAX Reviews for Content, with Star Ratings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-52213 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper Rate Star Review – AJAX Reviews for Content, with Star Ratings allows Reflected XSS.This issue affects Rate Star Review – AJAX Reviews for Content, with Star Ratings: from n/a through 1.5.1.
Product
Rate Star Review – AJAX Reviews for Content, with Star Ratings
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Rate Star Review – AJAX Reviews for Content, with Star Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: Deserialization of Untrusted DataCVE-2023-52225 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
Product
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Affected
up to 3.1
What to do
Affects up to 3.1. Update Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 1, 2024WP TripAdvisor Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6037 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP TripAdvisor Review Slider
Fixed in
11.9
What to do
Update WP TripAdvisor Review Slider to 11.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 29, 2023Library Viewer: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-32101 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pexle Chris Library Viewer.This issue affects Library Viewer: from n/a through 2.0.6.
Product
Library Viewer
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Library Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Recently Viewed Products: Deserialization of Untrusted DataCVE-2023-34027 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0.
Product
Recently Viewed Products
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Recently Viewed Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Slider: Does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the requestCVE-2023-6077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
Product
Slider
Fixed in
3.5.12
What to do
Update Slider to 3.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Vrm 360 3D Model Viewer: Is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcodeCVE-2023-4311 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode.
Product
Vrm 360 3D Model Viewer
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Vrm 360 3D Model Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: Cross-Site Request Forgery (CSRF)CVE-2023-33214 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
Product
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Affected
up to 3.1
What to do
Affects up to 3.1. Update Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023WP Customer Reviews: Sensitive Information ExposureCVE-2023-4686 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.
Product
WP Customer Reviews
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 18, 2023Plainview Protect Passwords: Cross-Site Request Forgery (CSRF)CVE-2023-47664 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview Plainview Protect Passwords.This issue affects Plainview Protect Passwords: from n/a through 1.4.
Product
Plainview Protect Passwords
Affected
up to 1.4
What to do
Affects up to 1.4. Update Plainview Protect Passwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions.CVE-2023-28987 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions.
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023ReviewX – Multi-criteria Rating & Reviews for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46809 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.
Product
ReviewX – Multi-criteria Rating & Reviews for WooCommerce
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update ReviewX – Multi-criteria Rating & Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Site Reviews: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46801 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.
Product
Site Reviews
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46802 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
Product
Product Reviews Import Export for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Product Reviews Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions.CVE-2023-46085 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.2.4 versions.
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023WP Customer Reviews: Stored Cross-Site ScriptingCVE-2023-4648 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Customer Reviews
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2023Widgets for Google Reviews: Cross-Site Request ForgeryCVE-2023-3254 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Widgets for Google Reviews
Affected
up to 10.9
What to do
Affects up to 10.9. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2023Vrm 360 3D Model Viewer: Exposes the full path of a fileCVE-2023-5177 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode.
Product
Vrm 360 3D Model Viewer
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Vrm 360 3D Model Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.CVE-2023-45048 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.
Affected
up to 5.00
What to do
Affects up to 5.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Naresh Parmar Post View Count plugin <= 1.8.2 versions.CVE-2023-44996 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Naresh Parmar Post View Count plugin <= 1.8.2 versions.
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview MyCryptoCheckout plugin <= 2.125 versions.CVE-2023-41693 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview MyCryptoCheckout plugin <= 2.125 versions.
Affected
up to 2.125
What to do
Affects up to 2.125. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2023Absolute Reviews: Cross-Site Request ForgeryCVE-2021-4426 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the metabox_review_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Absolute Reviews
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Absolute Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.