Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

347new WordPress flaws this week

390,007entries in the database

133 results · page 1 of 3

Oct 15, 2026WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-eventCVE-2026-111163 · Other software · Mindwerks · reported by VulnCheckMedium 6.8
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.
Product
WildMIDI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 15, 2026WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via undCVE-2026-111162 · Other software · Mindwerks · reported by VulnCheckMedium 6.9
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().
Product
WildMIDI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 15, 2026AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.CVE-2026-104586 · Other software · reported by MITRECritical 9.8
AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 2, 2026There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.CVE-2026-93697 · Other software · Webpros · reported by support@hackerone.comCritical 9
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
Product
cPanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Oct 2, 2026There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.CVE-2026-93029 · Other software · Webpros · reported by support@hackerone.comCritical 9
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
Product
cPanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 14, 2026Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.CVE-2026-67399 · Other software · WebPros · reported by support@hackerone.comCritical 9.3
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
Product
WHMCS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.whmcs.com
Sep 9, 2026Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc.CVE-2026-16272 · Other software · PayTR Payment and Electronic Money Institution Inc. · reported by iletisim@usom.gov.trCritical 9.1
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.
Product
PayTR Virtual Pos iFrame API WHMCS Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Sep 8, 2026Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc.CVE-2026-16037 · Other software · PayTR Payment and Electronic Money Institution Inc. · reported by iletisim@usom.gov.trHigh 7.5
Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.
Product
PayTR Virtual Pos iFrame API WHMCS Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Sep 8, 2026Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc.CVE-2026-16025 · Other software · PayTR Payment and Electronic Money Institution Inc. · reported by iletisim@usom.gov.trHigh 7.5
Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.
Product
PayTR Virtual Pos iFrame API WHMCS Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr
Sep 3, 2026Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL CVE-2026-67398 · Other software · WebPros · reported by support@hackerone.comHigh 8.2
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.
Product
WHMCS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.whmcs.com
Jul 8, 2026WHMCS Bridge: Arbitrary file uploadsCVE-2026-14489 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect() function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WHMCS Bridge
Affected
up to 6.9
What to do
Affects up to 6.9. Update WHMCS Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 12, 2026WordPress Toolkit before 6.11.0 as used in cPanel & WHM,: Argument injectionCVE-2026-47365 · WordPress plugins & themes · reported by support@hackerone.comCritical 9.9
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.
Product
WordPress Toolkit before 6.11.0 as used in cPanel & WHM,
Fixed in
6.11.0
What to do
Update WordPress Toolkit before 6.11.0 as used in cPanel & WHM, to 6.11.0 or newer.
Full record and what to do →NVD record support.cpanel.net
May 12, 2026Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownershiCVE-2026-29204 · Other software · WebPros · reported by support@hackerone.comCritical 9.1
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading to unauthorized access to the victim's account.
Product
WHMCS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.whmcs.com
Apr 29, 2026WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityCVE-2026-41940 · WordPress plugins & themes · reported by VulnCheckExploitedRansomwareCritical 9.3
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Product
cPanel & WHM and WP2 (WordPress Squared)
On CISA’s list since
Apr 30, 2026 (federal fix deadline May 3, 2026)
What to do
Attackers are using this now. Install WebPros’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.cpanel.net docs.wpsquared.com
Apr 20, 2026A vulnerability has been found in Lagom WHMCS Template up to 2.4.2.CVE-2026-6601 · Other software · Lagom · reported by VulDBLow 2.1
A vulnerability has been found in Lagom WHMCS Template up to 2.4.2. This impacts an unknown function of the component Datatables. The manipulation leads to resource consumption. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
WHMCS Template
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Mar 16, 2026A vulnerability was found in Lagom WHMCS Template up to 2.3.7.CVE-2026-4239 · Other software · Lagom · reported by VulDBLow 2
A vulnerability was found in Lagom WHMCS Template up to 2.3.7. Impacted is an unknown function of the component Datatables. The manipulation results in improperly controlled modification of object prototype attributes. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
WHMCS Template
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 24, 2025WPBakery Visual Composer WHMCS Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68574 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows DOM-Based XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through <= 1.0.4.3.
Product
WPBakery Visual Composer WHMCS Elements
Affected
up to 1.0.4.3
What to do
Affects up to 1.0.4.3. Update WPBakery Visual Composer WHMCS Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 22, 2025Void Elementor WHMCS Elements For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62094 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidthemes Void Elementor WHMCS Elements For Elementor Page Builder void-elementor-whmcs-elements.This issue affects Void Elementor WHMCS Elements For Elementor Page Builder: from n/a through <= 2.0.1.2.
Product
Void Elementor WHMCS Elements For Elementor Page Builder
Affected
up to 2.0.1.2
What to do
Affects up to 2.0.1.2. Update Void Elementor WHMCS Elements For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025WHMpress: Path TraversalCVE-2025-39492 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision.
Product
WHMpress
What to do
Update WHMpress to the newest version.
Full record and what to do →NVD record patchstack.com
May 16, 2025WHMpress: Path TraversalCVE-2025-39491 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.
Product
WHMpress
What to do
Update WHMpress to the newest version.
Full record and what to do →NVD record patchstack.com
May 7, 2025WPBakery Visual Composer WHMCS Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47659 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows Stored XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through <= 1.0.4.3.
Product
WPBakery Visual Composer WHMCS Elements
Affected
up to 1.0.4.3
What to do
Affects up to 1.0.4.3. Update WPBakery Visual Composer WHMCS Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 19, 2025GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint.CVE-2025-43921 · Other software · GNU · reported by MITREMedium 5.3
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
Product
Mailman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.launchpad.net github.com
Apr 19, 2025GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commanCVE-2025-43920 · Other software · GNU · reported by MITREMedium 5.4
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
Product
Mailman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.launchpad.net github.com
Apr 19, 2025GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/maiCVE-2025-43919 · Other software · GNU · reported by MITREMedium 5.8
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
Product
Mailman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.launchpad.net github.com
Feb 28, 2025WHMPress - WHMCS Client Area: Unauthorized modification of data that can lead to privilege escalationCVE-2024-9195 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the update_settings case in the /admin/ajax.php file in all versions up to, and including, 4.3-revision-3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WHMPress - WHMCS Client Area
Affected
up to 4.3-revision-3
What to do
Affects up to 4.3-revision-3. Update WHMPress - WHMCS Client Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 28, 2025WHMpress - WHMCS WordPress Integration: Local File InclusionCVE-2024-9193 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WHMpress - WHMCS WordPress Integration
Affected
up to 6.3-revision-0
What to do
Affects up to 6.3-revision-0. Update WHMpress - WHMCS WordPress Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record whmpress.com wordfence.com
Feb 27, 2025Arbitrary file overwrite during home directory recovery due to improper symbolic link handling.CVE-2025-24832 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.7.615.
Product
Acronis Backup plugin for cPanel & WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Nov 21, 2024WPBakery Visual Composer WHMCS Elements: Stored Cross-Site ScriptingCVE-2024-10172 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's void_wbwhmcse_laouts_search shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPBakery Visual Composer WHMCS Elements
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WPBakery Visual Composer WHMCS Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 14, 2024Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive information via modificCVE-2024-40579 · Other software · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive information via modification of the hostname parameter.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vxcyber.com
Nov 11, 2024Sensitive information disclosure during file browsing due to improper symbolic link handling.CVE-2024-34015 · Other software · Acronis · reported by security@acronis.comLow 3.3
Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892.
Product
Acronis Backup plugin for cPanel & WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Nov 11, 2024Arbitrary file overwrite during recovery due to improper symbolic link handling.CVE-2024-34014 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.6.599, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.2.181.
Product
Acronis Backup plugin for cPanel & WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 17, 2024Sensitive data disclosure and manipulation due to unnecessary privileges assignment.CVE-2024-8767 · Other software · Acronis · reported by security@acronis.comCritical 9.9
Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.
Product
Acronis Backup plugin for cPanel & WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Aug 19, 2024WHMpress: Missing AuthorizationCVE-2024-43247 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in creativeon WHMpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WHMpress: from n/a through 6.2-revision-5.
Product
WHMpress
Affected
up to 6.2-revision-5
What to do
Affects up to 6.2-revision-5. Update WHMpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024WHMpress: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43246 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in creativeon WHMpress allows Reflected XSS.This issue affects WHMpress: from n/a through 6.2-revision-5.
Product
WHMpress
Affected
up to 6.2-revision-5
What to do
Affects up to 6.2-revision-5. Update WHMpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 18, 2024Void Elementor WHMCS Elements For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32592 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VoidCoders, innovs Void Elementor WHMCS Elements For Elementor Page Builder allows Stored XSS.This issue affects Void Elementor WHMCS Elements For Elementor Page Builder: from n/a through 2.0.
Product
Void Elementor WHMCS Elements For Elementor Page Builder
Affected
up to 2.0
What to do
Affects up to 2.0. Update Void Elementor WHMCS Elements For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 4, 2023Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers CVE-2022-42175 · Other software · Soluslabs · reported by MITREHigh 8.8
Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization.
Product
Solusvm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Jul 10, 2022The whmacmac/vprj repository through 2022-04-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31563 · Other software · Vprj Project · reported by MITRECritical 9.3
The whmacmac/vprj repository through 2022-04-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Product
Vprj
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 4, 2022Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.CVE-2022-0855 · Other software · microweber-dev · reported by security@huntr.devMedium 6.1
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.
Product
microweber-dev/whmcs_plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Feb 28, 2022WHMCS Bridge: Does not sanitise and escape the error parameter before outputting it back in admin dashboardCVE-2021-25112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
Product
WHMCS Bridge
Fixed in
6.4b
What to do
Update WHMCS Bridge to 6.4b or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 18, 2022WHMCS Bridge: Stored Cross-Site ScriptingCVE-2021-4074 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the cc_whmcs_bridge_add_admin function, low-level authenticated users such as subscribers can exploit this vulnerability.
Product
WHMCS Bridge
Affected
up to 6.1
What to do
Affects up to 6.1. Update WHMCS Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 11, 2021The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).CVE-2021-38585 · Websites & servers · Cpanel · reported by MITREHigh 7.2
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Aug 11, 2021The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).CVE-2021-38584 · Websites & servers · Cpanel · reported by MITREHigh 7.2
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Nov 26, 2020cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).CVE-2020-29137 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net news.cpanel.com
Sep 25, 2020cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).CVE-2020-26113 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).CVE-2020-26111 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Mar 17, 2020cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).CVE-2019-20497 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 5, 2020IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script.CVE-2020-9380 · Other software · Whmcssmarters · reported by MITRECritical 9.8
IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script.
Product
Web TV Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com whmcssmarters.com
Feb 10, 2020The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.CVE-2012-6449 · Websites & servers · Cpanel · reported by MITREMedium 5.4
The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jan 27, 2020Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2012-6448 · Websites & servers · Cpanel · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Webhost Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 9, 2019cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).CVE-2019-17380 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.