Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
44 results
Oct 16, 2026Coinsnap Bitcoin Crowdfunding: Does not restrict access to the secret used to authenticate its payment gateway webhookCVE-2026-92427 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.
- Product
- Coinsnap Bitcoin Crowdfunding
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Coinsnap Bitcoin Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Crowdfundly: Does not have capability checks on some of its AJAX actionsCVE-2026-85126 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
- Product
- Crowdfundly
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Crowdfundly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 18, 2026Save as PDF Plugin by PDFCrowd: Arbitrary Function InvocationCVE-2026-92807 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_callback` shortcode attribute. The `eval_shortcode()` function copies any non-`button_`/non-`email_` shortcode attribute verbatim into a custom options array without sanitization, allowlist enforcement, or capability checks, and `create_button()` AES-encrypts that array — including the attacker-supplied callback value — and embeds the resulting blob in the rendered button HTML; when the blob is later POSTed to the unauthenticated `wp_ajax_nopriv_save_as_pdf_pdfcrowd` endpoint, `save_as_pdf_pdfcrowd()` decrypts it and invokes `$options['pdf_created_callback']` as a PHP callable at line 1722 with no `is_callable()` guard, no allowlist, and no capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to invoke arbitrary PHP functions or static class methods with plugin option data as the sole argument, enabling disclosure of the site's stored PDFCrowd API key and username or further server-side abuse. Note that the encryption boundary does not mitigate this vector bec
- Product
- Save as PDF Plugin by PDFCrowd
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update Save as PDF Plugin by PDFCrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026WP Crowdfunding: Stored Cross-Site ScriptingCVE-2026-19945 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An administrator viewing any user's profile via the ?show_user_id= parameter will render the attacker's stored payload in the admin's browser session, enabling cross-privilege script execution.
- Product
- WP Crowdfunding
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026WP Crowdfunding: Generic SQL InjectionCVE-2026-19944 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Shop Manager writes the malicious payload once via the WooCommerce REST products endpoint (POST/PUT /wp-json/wc/v3/products/{id}), and the injected query executes on every subsequent public page view that renders the campaign rewards sidebar.
- Product
- WP Crowdfunding
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026FundEngine – Donation and Crowdfunding Platform: Stored Cross-Site ScriptingCVE-2026-76063 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_video_url' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint used to submit the video URL has its permission_callback set to __return_true, meaning any authenticated user — including those with Subscriber-level access — can reach the vulnerable code path.
- Product
- FundEngine – Donation and Crowdfunding Platform
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update FundEngine – Donation and Crowdfunding Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026FundEngine – Donation and Crowdfunding Platform: Authorization bypassCVE-2026-75930 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary posts and pages — overwriting title and content, and seizing ownership by supplying an attacker-controlled post_author integer that bypasses wp_kses_post sanitization. The wp_rest nonce required by the handler is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier.
- Product
- FundEngine – Donation and Crowdfunding Platform
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update FundEngine – Donation and Crowdfunding Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 12, 2026WP Crowdfunding: Does not check the campaign-submission capability in one of its AJAX actionsCVE-2026-14859 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.
- Product
- WP Crowdfunding
- Fixed in
- 2.2.1
- What to do
- Update WP Crowdfunding to 2.2.1 or newer.
Aug 12, 2026WP Crowdfunding: Does not verify order ownership before returning order detailsCVE-2026-14858 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store.
- Product
- WP Crowdfunding
- Fixed in
- 2.2.1
- What to do
- Update WP Crowdfunding to 2.2.1 or newer.
Aug 12, 2026WP Crowdfunding: Does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backersCVE-2026-14857 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns.
- Product
- WP Crowdfunding
- Fixed in
- 2.2.1
- What to do
- Update WP Crowdfunding to 2.2.1 or newer.
Jun 9, 2026Helpfulcrowd Product Reviews: Authorization BypassCVE-2026-8499 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the `helpfulcrowd_validate_token()` function using a loose comparison operator (`!=`) instead of a strict comparison (`!==`) when validating the `token` parameter, while the corresponding REST route `/wp-json/helpfulcrowd/v1/update-settings` is registered with a `permission_callback` of `__return_true`, making it reachable by unauthenticated users; submitting a JSON boolean `true` as the `token` value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This makes it possible for unauthenticated attackers to invoke `helpfulcrowd_settings_endpoint()` and write arbitrary attacker-controlled key-value pairs directly into the `helpfulcrowd_options` WordPress database option via `update_option()` without any sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.
- Product
- Helpfulcrowd Product Reviews
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Helpfulcrowd Product Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 24, 2026Save as PDF Plugin by PDFCrowd: Reflected Cross-Site ScriptingCVE-2026-0862 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘options’ parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. NOTE: Successful exploitation of this vulnerability requires that the PDFCrowd API key is blank (also known as "demo mode", which is the default configuration when the plugin is installed) or known.
- Product
- Save as PDF Plugin by PDFCrowd
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update Save as PDF Plugin by PDFCrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 30, 2025Crowdsignal Forms: Missing AuthorizationCVE-2025-69015 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.
- Product
- Crowdsignal Forms
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Crowdsignal Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2025WhyDonate – FREE Donate button – Crowdfunding – Fundraising: Unauthorized loss of dataCVE-2025-10186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
- Product
- WhyDonate – FREE Donate button – Crowdfunding – Fundraising
- Affected
- up to 4.0.15
- What to do
- Affects up to 4.0.15. Update WhyDonate – FREE Donate button – Crowdfunding – Fundraising to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 18, 2025Crowdfunding for WooCommerce: Stored Cross-Site ScriptingCVE-2025-5767 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Crowdfunding for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Crowdfunding for WooCommerce
- Affected
- up to 3.1.14
- What to do
- Affects up to 3.1.14. Update Crowdfunding for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 15, 2025Save as Image Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2024-3062 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as Image Plugin by Pdfcrowd
- Fixed in
- 3.2.2
- What to do
- Update Save as Image Plugin by Pdfcrowd to 3.2.2 or newer.
Apr 17, 2025Crowdfunding for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32628 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Crowdfunding for WooCommerce crowdfunding-for-woocommerce allows Reflected XSS.This issue affects Crowdfunding for WooCommerce: from n/a through <= 3.1.12.
- Product
- Crowdfunding for WooCommerce
- Affected
- up to 3.1.12
- What to do
- Affects up to 3.1.12. Update Crowdfunding for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Social Crowd: Cross-Site Request Forgery (CSRF)CVE-2025-31390 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bdoga Social Crowd social-crowd allows Stored XSS.This issue affects Social Crowd: from n/a through <= 0.9.6.1.
- Product
- Social Crowd
- Affected
- up to 0.9.6.1
- What to do
- Affects up to 0.9.6.1. Update Social Crowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Crowdfunding: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31892 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding wp-crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through <= 2.1.15.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.15
- What to do
- Affects up to 2.1.15. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 12, 2025WP Crowdfunding: Unauthorized access of dataCVE-2025-1508 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to download all of a site's post content when WooCommerce is installed.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.14
- What to do
- Affects up to 2.1.14. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 13, 2024WP Crowdfunding: Missing AuthorizationCVE-2023-41870 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Crowdfunding: Unauthorized plugin installationCVE-2024-11911 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 13, 2024WP Crowdfunding: Stored Cross-Site ScriptingCVE-2024-11910 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.15
- What to do
- Affects up to 2.1.15. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 20, 2024Save as PDF Plugin by Pdfcrowd: Stored Cross-Site ScriptingCVE-2024-10891 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'save_as_pdf_pdfcrowd' shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Save as PDF Plugin by Pdfcrowd
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Save as PDF Plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 19, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2024-43338 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through <= 3.1.3.
- Product
- Crowdsignal Dashboard – Polls, Surveys & more
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Crowdfunding: Missing AuthorizationCVE-2024-43937 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2024WP Crowdfunding: Stored Cross-Site ScriptingCVE-2024-10117 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.11
- What to do
- Affects up to 2.1.11. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.themeum.complugins.trac.wordpress.org
Jul 26, 2024IgnitionDeck Crowdfunding Platform: Missing AuthorizationCVE-2024-4410 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the ~/classes/class-idf-wizard.php file. This makes it possible for authenticated attackers, with subscriber access or higher, to execute various AJAX actions. This includes actions to change the permalink structure, plugin settings and others.
- Product
- IgnitionDeck Crowdfunding Platform
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update IgnitionDeck Crowdfunding Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 21, 2024Save as PDF plugin by Pdfcrowd: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37549 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 4.0.0.
- Product
- Save as PDF plugin by Pdfcrowd
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Save as PDF plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 11, 2024WP Fundraising Donation and Crowdfunding Platform: Missing AuthorizationCVE-2024-34758 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wpmet WP Fundraising Donation and Crowdfunding Platform.This issue affects WP Fundraising Donation and Crowdfunding Platform: from n/a through 1.6.4.
- Product
- WP Fundraising Donation and Crowdfunding Platform
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update WP Fundraising Donation and Crowdfunding Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Save as PDF plugin by Pdfcrowd: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35649 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.3.
- Product
- Save as PDF plugin by Pdfcrowd
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Save as PDF plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Save as PDF Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2023-5971 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as PDF Plugin by Pdfcrowd
- Fixed in
- 3.2.0
- What to do
- Update Save as PDF Plugin by Pdfcrowd to 3.2.0 or newer.
Apr 29, 2024Save as PDF plugin by Pdfcrowd: Missing AuthorizationCVE-2024-33684 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.0.
- Product
- Save as PDF plugin by Pdfcrowd
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Save as PDF plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 11, 2024Save as Image plugin by Pdfcrowd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31931 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Save as Image plugin by Pdfcrowd allows Stored XSS.This issue affects Save as Image plugin by Pdfcrowd: from n/a through 3.2.1 .
- Product
- Save as Image plugin by Pdfcrowd
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Save as Image plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 11, 2024Save as PDF plugin by Pdfcrowd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31930 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.1 .
- Product
- Save as PDF plugin by Pdfcrowd
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Save as PDF plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 15, 2024Crowdsignal Dashboard – Polls, Surveys & more: Cross-Site Request Forgery (CSRF)CVE-2023-51489 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.
- Product
- Crowdsignal Dashboard – Polls, Surveys & more
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 10, 2024Crowdsignal Dashboard – Polls, Surveys & more: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51488 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more allows Reflected XSS.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.
- Product
- Crowdsignal Dashboard – Polls, Surveys & more
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update Crowdsignal Dashboard – Polls, Surveys & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 15, 2024WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-6163 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Crowdfunding
- Fixed in
- 2.1.10
- What to do
- Update WP Crowdfunding to 2.1.10 or newer.
Jan 8, 2024WP Crowdfunding: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-6161 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Crowdfunding
- Fixed in
- 2.1.9
- What to do
- Update WP Crowdfunding to 2.1.9 or newer.
Dec 28, 2023WP Crowdfunding: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50859 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6.
- Product
- WP Crowdfunding
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 11, 2023WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-5757 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Crowdfunding
- Fixed in
- 2.1.8
- What to do
- Update WP Crowdfunding to 2.1.8 or newer.
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Whydonate Whydonate – FREE Donate button – Crowdfunding – Fundraising plugin <= 3.12.15 versions.CVE-2023-29238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Whydonate Whydonate – FREE Donate button – Crowdfunding – Fundraising plugin <= 3.12.15 versions.
- Affected
- up to 3.12.15
- What to do
- Affects up to 3.12.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 8, 2022Crowdsignal Dashboard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2386 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Crowdsignal Dashboard
- Fixed in
- 3.0.8
- What to do
- Update Crowdsignal Dashboard to 3.0.8 or newer.
Jun 8, 2022WP Fundraising Donation and Crowdfunding Platform: Does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST routeCVE-2022-0788 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users
- Product
- WP Fundraising Donation and Crowdfunding Platform
- Fixed in
- 1.5.0
- What to do
- Update WP Fundraising Donation and Crowdfunding Platform to 1.5.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.