Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

55 results · page 1 of 2

Oct 29, 2026Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.CVE-2026-118078 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115596 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.
Product
eCommerce Product Catalog
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105056 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2.
Product
eCommerce Product Catalog
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.CVE-2026-96344 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 8, 2026EDD Product Catalog Feed by PixelYourSite: Unauthorized modification of data that can lead to a denial of serviceCVE-2026-9331 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
EDD Product Catalog Feed by PixelYourSite
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update EDD Product Catalog Feed by PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pixelyoursite.com wordfence.com
Sep 8, 2026Product Catalog Enquiry for WooCommerce by MultiVendorX: Incorrect Privilege AssignmentCVE-2026-81792 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 6.1.5.
Product
Product Catalog Enquiry for WooCommerce by MultiVendorX
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update Product Catalog Enquiry for WooCommerce by MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026CatalogX: Does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administratorCVE-2026-79621 · WordPress plugins & themes · reported by WPScanMedium 4.3
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
Product
CatalogX
Fixed in
6.1.3
What to do
Update CatalogX to 6.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026eCommerce Product Catalog: Stored Cross-Site ScriptingCVE-2026-76128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags; the tainted HTML output is only generated at render time by the shortcode handler.
Product
eCommerce Product Catalog
Affected
up to 3.5.10
What to do
Affects up to 3.5.10. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.CVE-2026-57360 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.CVE-2026-52693 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or adCVE-2016-20075 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record etoilewebdesign.com exploit-db.com
Jun 9, 2026Product Catalog 8 1.2: SQL injectionCVE-2016-20065 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.
Product
Product Catalog 8 1.2
What to do
Update Product Catalog 8 1.2 to the newest version.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
May 19, 2026Games Catalog: Cross-Site Request ForgeryCVE-2026-8418 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the gc_crud() function which handles the delete action (action=delete) via a GET request without any wp_verify_nonce() / check_admin_referer() call. This makes it possible for unauthenticated attackers to delete arbitrary game catalog entries (including the associated WordPress post created for the game) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Games Catalog
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Games Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 10, 2026Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through thCVE-2021-47924 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter. Attackers can submit POST requests to post.php with HTML/JavaScript payloads in the price field to execute arbitrary code when the product is viewed.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org etoilewebdesign.com
Dec 5, 2025PDF Catalog for WooCommerce: Stored Cross-Site ScriptingCVE-2025-12191 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The PDF Catalog for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdfcatalog' AJAX action in all versions up to, and including, 1.1.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PDF Catalog for WooCommerce
Affected
up to 1.1.18
What to do
Affects up to 1.1.18. Update PDF Catalog for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 18, 2025wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions: Authorization bypassCVE-2025-12639 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive information including user emails, usernames, roles, capabilities, and WooCommerce data such as products and payment methods.
Product
wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025Product Catalog Simple: Cross-Site Request Forgery (CSRF)CVE-2025-62061 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in impleCode Product Catalog Simple post-type-x.This issue affects Product Catalog Simple: from n/a through <= 1.8.4.
Product
Product Catalog Simple
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Product Catalog Simple: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58992 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.2.
Product
Product Catalog Simple
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2025Catalog Importer, Scraper & Crawler: PHP code injectionCVE-2025-8417 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authentication, combined with the unsafe use of eval() on user-supplied input. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server via a forged request granted they can guess or brute-force the numeric key.
Product
Catalog Importer, Scraper & Crawler
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update Catalog Importer, Scraper & Crawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2025eCommerce Product Catalog: Deserialization of Untrusted DataCVE-2025-49331 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through <= 3.4.3.
Product
eCommerce Product Catalog
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Product Catalog Simple: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49305 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.1.
Product
Product Catalog Simple
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Product Catalog: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30524 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through <= 1.0.4.
Product
Product Catalog
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 28, 2025Product Catalog Simple: Stored Cross-Site ScriptingCVE-2025-1405 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Product Catalog Simple
Affected
up to 1.7.11
What to do
Affects up to 1.7.11. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 26, 2025Simple catalogue: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13633 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Simple catalogue
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Simple catalogue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 3, 2025Catalog Importer, Scraper & Crawler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-importer allows Reflected XSS.This issue affects Catalog Importer, Scraper & Crawler: from n/a through <= 5.1.3.
Product
Catalog Importer, Scraper & Crawler
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update Catalog Importer, Scraper & Crawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025PDF Catalog Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22809 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through <= 2.0.
Product
PDF Catalog Woocommerce
Affected
up to 2.0
What to do
Affects up to 2.0. Update PDF Catalog Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 21, 2024eCommerce Product Catalog Plugin for: Cross-Site Request ForgeryCVE-2024-12771 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customer_panel_password_reset' function. This makes it possible for unauthenticated attackers to reset the password of any administrator or customer account via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
eCommerce Product Catalog Plugin for
Affected
up to 3.3.43
What to do
Affects up to 3.3.43. Update eCommerce Product Catalog Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024Product Catalog Enquiry for WooCommerce by MultiVendorX: Missing AuthorizationCVE-2023-50899 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.2.
Product
Product Catalog Enquiry for WooCommerce by MultiVendorX
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Product Catalog Enquiry for WooCommerce by MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 27, 2024Product Enquiry for WooCommerce, WooCommerce product catalog: PHP Object InjectionCVE-2024-8922 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Product Enquiry for WooCommerce, WooCommerce product catalog plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.33.32 via deserialization of untrusted input in enquiry_detail.php. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Product Enquiry for WooCommerce, WooCommerce product catalog
Affected
up to 2.2.33.32
What to do
Affects up to 2.2.33.32. Update Product Enquiry for WooCommerce, WooCommerce product catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2024Product Catalog Enquiry for WooCommerce by MultiVendorX: Missing AuthorizationCVE-2024-25929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.5.
Product
Product Catalog Enquiry for WooCommerce by MultiVendorX
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update Product Catalog Enquiry for WooCommerce by MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.3.32.
Product
eCommerce Product Catalog
Affected
up to 3.3.32
What to do
Affects up to 3.3.32. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Ultimate Product Catalogue: Cross-Site Request Forgery (CSRF)CVE-2024-31921 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Ultimate Product Catalogue.This issue affects Ultimate Product Catalogue: from n/a through 5.2.15.
Product
Ultimate Product Catalogue
Affected
up to 5.2.15
What to do
Affects up to 5.2.15. Update Ultimate Product Catalogue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024eCommerce Product Catalog: Cross-Site Request Forgery (CSRF)CVE-2024-32437 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in impleCode eCommerce Product Catalog.This issue affects eCommerce Product Catalog: from n/a through 3.3.28.
Product
eCommerce Product Catalog
Affected
up to 3.3.28
What to do
Affects up to 3.3.28. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, DynamiCVE-2022-34344 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More: from n/a through 2.1.5.
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023eCommerce Product Catalog Plugin for: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51688 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26.
Product
eCommerce Product Catalog Plugin for
Affected
up to 3.3.26
What to do
Affects up to 3.3.26. Update eCommerce Product Catalog Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Product Catalog Simple: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51687 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.This issue affects Product Catalog Simple: from n/a through 1.7.6.
Product
Product Catalog Simple
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Product Catalog Mode For WooCommerce: Does not properly authorize settings updates or escape settings valuesCVE-2023-5348 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
Product
Product Catalog Mode For WooCommerce
Fixed in
5.0.3
What to do
Update Product Catalog Mode For WooCommerce to 5.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 17, 2023Product Catalog Feed by PixelYourSite: Cross-Site Request Forgery (CSRF)CVE-2023-49824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite Product Catalog Feed by PixelYourSite.This issue affects Product Catalog Feed by PixelYourSite: from n/a through 2.1.1.
Product
Product Catalog Feed by PixelYourSite
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Product Catalog Feed by PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023WP Catalogue: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnigmaWeb WP Catalogue allows Stored XSS.This issue affects WP Catalogue: from n/a through 1.7.6.
Product
WP Catalogue
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update WP Catalogue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 4, 2023eCommerce Product Catalog Plugin for: Does not have CSRF checks in some of its admin pagesCVE-2023-5979 · WordPress plugins & themes · reported by WPScanMedium 6.5
The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products
Product
eCommerce Product Catalog Plugin for
Fixed in
3.3.26
What to do
Update eCommerce Product Catalog Plugin for to 3.3.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress pCVE-2023-47839 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.26 versions.
Affected
up to 3.3.26
What to do
Affects up to 3.3.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 1, 2023eCommerce Product Catalog Plugin for: Cross-Site Request ForgeryCVE-2021-4393 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save manual digital orders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
eCommerce Product Catalog Plugin for
Affected
up to 3.0.17
What to do
Affects up to 3.0.17. Update eCommerce Product Catalog Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023eCommerce Product Catalog Plugin for: Cross-Site Request ForgeryCVE-2021-4392 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. This is due to missing or incorrect nonce validation on the implecode_save_products_meta() function. This makes it possible for unauthenticated attackers to save product meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
eCommerce Product Catalog Plugin for
Affected
up to 2.9.43
What to do
Affects up to 2.9.43. Update eCommerce Product Catalog Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023Product Catalog Simple: Cross-Site Request ForgeryCVE-2020-36743 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This is due to missing or incorrect nonce validation on the implecode_save_products_meta() function. This makes it possible for unauthenticated attackers to update product meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Product Catalog Simple
Affected
up to 1.5.13
What to do
Affects up to 1.5.13. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 27, 2023Ultimate Product Catalog: Does not sanitise and escape some of its settingsCVE-2023-2711 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Ultimate Product Catalog
Fixed in
5.2.6
What to do
Update Ultimate Product Catalog to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the page parameter before outputting it back in an attributeCVE-2023-1805 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Product Catalog Feed by PixelYourSite
Fixed in
2.1.1
What to do
Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the edit parameter before outputting it back in an attributeCVE-2023-1804 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
Product
Product Catalog Feed by PixelYourSite
Fixed in
2.1.1
What to do
Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 17, 2023eCommerce Product Catalog: Stored Cross-Site ScriptingCVE-2023-1470 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
eCommerce Product Catalog
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 11, 2022Portfolio Gallery, Product Catalog: Does not have authorisation and CSRF checks in various functions related to AJAX actionsCVE-2021-25090 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
Product
Portfolio Gallery, Product Catalog
Fixed in
2.1.0
What to do
Update Portfolio Gallery, Product Catalog to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Ultimate Product Catalog: Does not have authorisation and CSRF checks in some AJAX actionsCVE-2021-24993 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
Product
Ultimate Product Catalog
Fixed in
5.0.26
What to do
Update Ultimate Product Catalog to 5.0.26 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.