Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
706 results · page 9 of 15
Dec 16, 2024Woolook: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54375 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Woolook woolook allows PHP Local File Inclusion.This issue affects Woolook: from n/a through <= 1.7.0.
- Product
- Woolook
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Woolook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Sogrid: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54374 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Sogrid sogrid allows PHP Local File Inclusion.This issue affects Sogrid: from n/a through <= 1.5.6.
- Product
- Sogrid
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Sogrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024EduAdmin Booking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54373 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chris Gardenberg EduAdmin Booking eduadmin-booking allows PHP Local File Inclusion.This issue affects EduAdmin Booking: from n/a through <= 5.2.0.
- Product
- EduAdmin Booking
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update EduAdmin Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Projectopia: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54336 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Projectopia Projectopia projectopia-core allows Authentication Bypass.This issue affects Projectopia: from n/a through <= 5.1.7.
- Product
- Projectopia
- Affected
- up to 5.1.7
- What to do
- Affects up to 5.1.7. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024FULL Customer: Path TraversalCVE-2024-54313 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal vulnerability in FULL. FULL Customer allows Path Traversal.This issue affects FULL Customer: from n/a through 3.1.25.
- Product
- FULL Customer
- Affected
- up to 3.1.25
- What to do
- Affects up to 3.1.25. Update FULL Customer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024vBSSO-lite: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54297 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in extremeidea vBSSO-lite vbsso-lite allows Authentication Bypass.This issue affects vBSSO-lite: from n/a through <= 1.4.3.
- Product
- vBSSO-lite
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update vBSSO-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024CoSchool LMS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54296 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Codexpert, Inc CoSchool LMS coschool allows Authentication Bypass.This issue affects CoSchool LMS: from n/a through <= 1.4.3.
- Product
- CoSchool LMS
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update CoSchool LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024ListApp Mobile Manager: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54295 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through <= 1.7.7.
- Product
- ListApp Mobile Manager
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update ListApp Mobile Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Firebase OTP Authentication: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-54294 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Appgenix Infotech Firebase OTP Authentication authentication-via-otp-using-firebase allows Authentication Bypass.This issue affects Firebase OTP Authentication: from n/a through <= 1.0.1.
- Product
- Firebase OTP Authentication
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Firebase OTP Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024DELUCKS SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54259 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
- Product
- DELUCKS SEO
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 10, 2024System Dashboard: Does not validate user input used in a pathCVE-2024-10708 · WordPress plugins & themes · reported by WPScanMedium 4.9
The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server
- Product
- System Dashboard
- Fixed in
- 2.8.15
- What to do
- Update System Dashboard to 2.8.15 or newer.
Dec 9, 2024Lenxel Core for Lenxel(LNX) LMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-53790 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PHP Local File Inclusion.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.
- Product
- Lenxel Core for Lenxel(LNX) LMS
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Lenxel Core for Lenxel(LNX) LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024ARForms: Path Traversal: '.../...//'CVE-2024-54216 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.
- Product
- ARForms
- Fixed in
- 7.0.2
- What to do
- Update ARForms to 7.0.2 or newer.
Nov 28, 2024SP Blog Designer: Path Traversal: '.../...//'CVE-2024-52498 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows PHP Local File Inclusion.This issue affects SP Blog Designer: from n/a through <= 1.0.0.
- Product
- SP Blog Designer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SP Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Pathomation: Unrestricted Upload of File with Dangerous TypeCVE-2024-52490 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through <= 2.5.1.
- Product
- Pathomation
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Pathomation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Jobify: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52481 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Astoundify Jobify jobify allows Relative Path Traversal.This issue affects Jobify: from n/a through < 4.3.0.
- Product
- Jobify
- Fixed in
- 4.2.4
- What to do
- Update Jobify to 4.2.4 or newer.
Nov 28, 2024Wawp: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-52475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Information Technology Wawp automation-web-platform allows Authentication Bypass.This issue affects Wawp: from n/a through < 3.0.18.
- Product
- Wawp
- What to do
- Update Wawp to the newest version.
Nov 27, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Path TraversalCVE-2024-11219 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.0.6 via the get_image function. This makes it possible for unauthenticated attackers to view arbitrary images on the server, which can contain sensitive information.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 23, 2024Increase Maximum Upload File Size | Increase Execution Time: Full Path DisclosureCVE-2024-11265 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.3. This is due to returning image upload error messages with full path information. This makes it possible for authenticated attackers, with author-level permissions and above, to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Increase Maximum Upload File Size | Increase Execution Time
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Increase Maximum Upload File Size | Increase Execution Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 20, 2024Bootscraper: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52449 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Navneil Naicer Bootscraper allows PHP Local File Inclusion.This issue affects Bootscraper: from n/a through 2.1.0.
- Product
- Bootscraper
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Bootscraper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Ultimate Classified Listings: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52448 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Contact Page With Google Map: Path Traversal: '.../...//'CVE-2024-52447 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Path Traversal: '.../...//' vulnerability in corporatezen222 Contact Page With Google Map contact-page-with-google-map allows Path Traversal.This issue affects Contact Page With Google Map: from n/a through <= 1.6.1.
- Product
- Contact Page With Google Map
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Contact Page With Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Opal Woo Custom Product Variation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52444 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through <= 1.1.3.
- Product
- Opal Woo Custom Product Variation
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Opal Woo Custom Product Variation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024CYAN Backup: Path Traversal: '.../...//'CVE-2024-52390 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through <= 2.5.3.
- Product
- CYAN Backup
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update CYAN Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 15, 2024PDF Generator Addon for Elementor Page Builder: Path TraversalCVE-2024-9935 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-24569 may be a duplicate of this issue.
- Product
- PDF Generator Addon for Elementor Page Builder
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update PDF Generator Addon for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 14, 2024WOLF: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52396 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue affects WOLF: from n/a through <= 1.0.8.3.
- Product
- WOLF
- Affected
- up to 1.0.8.3
- What to do
- Affects up to 1.0.8.3. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024DigiPass: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52378 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 DigiPass digipass allows Absolute Path Traversal.This issue affects DigiPass: from n/a through <= 0.3.0.
- Product
- DigiPass
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update DigiPass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Global Gateway e4 | Payeezy Gateway |: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52371 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway | globe-gateway-e4.This issue affects Global Gateway e4 | Payeezy Gateway |: from n/a through <= 2.0.
- Product
- Global Gateway e4 | Payeezy Gateway |
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Global Gateway e4 | Payeezy Gateway | to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 7, 2024Safe SVG: Has its sanitisation code is only running for paths that call wp_handle_uploadCVE-2024-8378 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.
- Product
- Safe SVG
- Fixed in
- 2.2.6
- What to do
- Update Safe SVG to 2.2.6 or newer.
Nov 4, 2024WP Hotel Booking: Path Traversal: '.../...//'CVE-2024-51582 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: from n/a through <= 2.2.9.
- Product
- WP Hotel Booking
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newspack Blocks: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37423 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8.
- Product
- Newspack Blocks
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WishList Member X: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37108 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishList Member X allows Path Traversal.This issue affects WishList Member X: from n/a through 3.26.6.
- Product
- WishList Member X
- Affected
- up to 3.26.6
- What to do
- Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50509 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- Product
- Woocommerce Product Design
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50508 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- Product
- Woocommerce Product Design
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024User Toolkit: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50503 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through <= 1.2.3.
- Product
- User Toolkit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update User Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024The Pack Elementor addons: Relative Path TraversalCVE-2024-50453 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elementor addons: from n/a through <= 2.0.9.
- Product
- The Pack Elementor addons
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Token Login: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50488 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token Login: from n/a through <= 1.0.3.
- Product
- Token Login
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Token Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Realty Workstation: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50489 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in realtyworkstation Realty Workstation realty-workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through <= 1.0.45.
- Product
- Realty Workstation
- Affected
- up to 1.0.45
- What to do
- Affects up to 1.0.45. Update Realty Workstation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024MaanStore API: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50487 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo MaanStore API maanstore-api allows Authentication Bypass.This issue affects MaanStore API: from n/a through <= 1.0.1.
- Product
- MaanStore API
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update MaanStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Acnoo Flutter API: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50486 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API acnoo-flutter-api allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through <= 1.0.5.
- Product
- Acnoo Flutter API
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Acnoo Flutter API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Stacks Mobile App Builder: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-50477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
- Product
- Stacks Mobile App Builder
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2024iBryl Switch User: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49675 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Vitalii iBryl Switch User ibryl-switch-user allows Authentication Bypass.This issue affects iBryl Switch User: from n/a through <= 1.0.1.
- Product
- iBryl Switch User
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update iBryl Switch User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Simple User Registration: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49604 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through <= 6.7.
- Product
- Simple User Registration
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024WP REST API FNS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49328 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
- Product
- WP REST API FNS
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP REST API FNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024SSV Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49286 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV Events ssv-events allows PHP Local File Inclusion.This issue affects SSV Events: from n/a through <= 3.2.7.
- Product
- SSV Events
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update SSV Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024PDF-Rechnungsverwaltung: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49287 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in mh6webentwicklung PDF-Rechnungsverwaltung pdf-rechnungsverwaltung allows PHP Local File Inclusion.This issue affects PDF-Rechnungsverwaltung: from n/a through <= 0.0.1.
- Product
- PDF-Rechnungsverwaltung
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update PDF-Rechnungsverwaltung to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024SSV MailChimp: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49285 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV MailChimp ssv-mailchimp allows PHP Local File Inclusion.This issue affects SSV MailChimp: from n/a through <= 3.1.5.
- Product
- SSV MailChimp
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update SSV MailChimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024FREE DOWNLOAD MANAGER: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49315 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through <= 1.0.0.
- Product
- FREE DOWNLOAD MANAGER
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update FREE DOWNLOAD MANAGER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024WordPress Gallery Plugin – Limb Image Gallery: Path Traversal: '.../...//'CVE-2024-49258 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal: '.../...//' vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through <= 1.5.7.
- Product
- WordPress Gallery Plugin – Limb Image Gallery
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update WordPress Gallery Plugin – Limb Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024Analyse Uploads: Relative Path TraversalCVE-2024-49253 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through <= 0.5.
- Product
- Analyse Uploads
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Analyse Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.