Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
61 results · page 1 of 2
Oct 20, 2026Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal pathCVE-2026-114110 · Other software · astral-sh · reported by VulnCheckHigh 8.7
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
- Product
- uv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts CVE-2026-114109 · Other software · astral-sh · reported by VulnCheckHigh 8.7
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
- Product
- uv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 16, 2026Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.CVE-2026-111451 · Other software · Wheels · reported by MITREHigh 7.8
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.
- Product
- Wheels CLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.CVE-2026-111450 · Other software · Wheels · reported by MITREMedium 5.9
Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).CVE-2026-111449 · Other software · Wheels · reported by MITREMedium 5.9
Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems.CVE-2026-111448 · Other software · Wheels · reported by MITRELow 3.7
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved.CVE-2026-111447 · Other software · Wheels · reported by MITREHigh 8.1
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in devCVE-2026-111446 · Other software · Wheels · reported by MITREHigh 8.6
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).CVE-2026-111445 · Other software · Wheels · reported by MITREHigh 8.1
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix combines key conditions with incoming scope, query-builder or where conditions in findByKey(), exists(key=), updateByKey() and deleteByKey(). Other scope-aware finders, aggregates, updateAll() and deleteAll() are not affected.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request daCVE-2026-111444 · Other software · Wheels · reported by MITRECritical 9.8
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-CVE-2026-111443 · Other software · Wheels · reported by MITREMedium 6.5
Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Spin Wheel: Does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize couponCVE-2026-106031 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
- Product
- Spin Wheel
- Fixed in
- 2.2.1
- What to do
- Update Spin Wheel to 2.2.1 or newer.
Oct 15, 2026Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the querCVE-2026-110911 · Other software · Wheels · reported by MITRECritical 9.8
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project.CVE-2026-110909 · Other software · Wheels · reported by MITREMedium 5
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.
- Product
- Wheels CLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Points and Rewards for WooCommerce: Does not validate the claimed reward amount or restrict who can call its Win Wheel claim handlerCVE-2026-93510 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
- Product
- Points and Rewards for WooCommerce
- Fixed in
- 2.10.4
- What to do
- Update Points and Rewards for WooCommerce to 2.10.4 or newer.
Aug 24, 2026The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.lCVE-2026-76843 · Other software · flairNLP · reported by VulnCheckHigh 8.4
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))) and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that attacker's code with the privileges of the loading process. This is the same sink and the same file as CVE-2024-10073, which records 0.15.0 as the fixed version on the basis that clustering support was dropped in that release; the module was removed from the documented API but remains present in the distributed artifact and reachable by importing flair.models.clustering directly, so the earlier record's fixed version does not hold for the shipped package.
- Product
- flair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code.CVE-2026-48813 · Other software · david-a-wheeler · reported by GitHubHigh 8.7
Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder's standard terminal output, with many effects. Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary XML attributes into SonarQube outputs via output_sonar(). It impacts those who use flawfinder to evaluate intentionally malicious filenames or file contents. This issue has been fully patched in Version 2.0.20 (released 2026-05-16). There is no configuration-based workaround within older versions of flawfinder. If an immediate upgrade is not possible, users can mitigate the risk by pre-scanning filenames, inspecting raw output, and/or restricting untrusted inputs.
- Product
- flawfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens aCVE-2026-18481 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.2
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel.
- Product
- AWS Ops Wheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Jul 2, 2026CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability.CVE-2026-13743 · Other software · CubeSpace · reported by ics-cert@hq.dhs.govLow 3.3
CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. This could allow an attacker with physical access to the product to upload arbitrary malicious firmware to the device without authentication.
- Product
- CW0057 Reaction Wheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names.CVE-2026-6357 · Other software · Pip maintainers · reported by cna@python.orgMedium 5.3
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
- Product
- pip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comichard26.github.io
Apr 24, 2026Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remCVE-2026-6912 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.7
Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the custom:deployment_admin attribute. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.
- Product
- AWS Ops Wheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Apr 24, 2026Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the applicCVE-2026-6911 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9.3
Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the deployment's User Pool, via a crafted JWT sent to the API Gateway endpoint. To remediate this issue, users should redeploy from the updated repository and ensure any forked or derivative code is patched to incorporate the new fixes.
- Product
- AWS Ops Wheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Mar 5, 2026Meals & Wheels: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27992 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Meals & Wheels meals-wheels allows PHP Local File Inclusion.This issue affects Meals & Wheels: from n/a through <= 1.1.12.
- Product
- Meals & Wheels
- Affected
- up to 1.1.12
- What to do
- Affects up to 1.1.12. Update Meals & Wheels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Wheel of Life: Missing AuthorizationCVE-2026-25000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through <= 1.2.0.
- Product
- Wheel of Life
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Wheel of Life to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 10, 2026Lucky Wheel Giveaway: Remote Code ExecutionCVE-2025-14541 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the conditional_tags parameter. This is due to the plugin using PHP's eval() function on user-controlled input without proper validation or sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
- Product
- Lucky Wheel Giveaway
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update Lucky Wheel Giveaway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 2, 2026When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory.CVE-2026-1703 · Other software · Python Packaging Authority · reported by cna@python.orgLow 2
When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
- Product
- pip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.CVE-2026-24049 · Other software · pypa · reported by GitHubHigh 7.1
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.
- Product
- wheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2026Spin Wheel: Client-side prize manipulationCVE-2026-0808 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.
- Product
- Spin Wheel
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Spin Wheel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2026WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections.CVE-2025-14346 · Other software · WHILL · reported by ics-cert@hq.dhs.govCritical 9.3
WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.
- Product
- Model C2 Electric Wheelchair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025Lucky Wheel for WooCommerce – Spin a Sale: PHP Code InjectionCVE-2025-14509 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13. This is due to the plugin using eval() to execute user-supplied input from the 'Conditional Tags' setting without proper validation or sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server. In WordPress multisite installations, this allows Site Administrators to execute arbitrary code, a capability they should not have since plugin/theme file editing is disabled for non-Super Admins in multisite environments.
- Product
- Lucky Wheel for WooCommerce – Spin a Sale
- Affected
- up to 1.1.13
- What to do
- Affects up to 1.1.13. Update Lucky Wheel for WooCommerce – Spin a Sale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 24, 2025Claspo – Popups, Spin the Wheel & Email Capture: Missing AuthorizationCVE-2025-68568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Claspo – Popups, Spin the Wheel & Email Capture: from n/a through <= 1.0.7.
- Product
- Claspo – Popups, Spin the Wheel & Email Capture
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Claspo – Popups, Spin the Wheel & Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Optin Wheel: Server-Side Request Forgery (SSRF)CVE-2025-31824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel wp-optin-wheel allows Server Side Request Forgery.This issue affects WP Optin Wheel: from n/a through <= 1.4.7.
- Product
- WP Optin Wheel
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update WP Optin Wheel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025BlockWheels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31817 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWheels BlockWheels blockwheels allows DOM-Based XSS.This issue affects BlockWheels: from n/a through <= 1.0.2.
- Product
- BlockWheels
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update BlockWheels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Input validation vulnerability in Qualifio's Wheel of Fortune.CVE-2025-0615 · Other software · Qualifio · reported by cve-coordination@incibe.esMedium 5.3
Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability allows an attacker to modify an email to contain the ‘+’ symbol to access the application and win prizes as many times as wanted.
- Product
- Wheel of fortune
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Input validation vulnerability in Qualifio's Wheel of Fortune.CVE-2025-0614 · Other software · Qualifio · reported by cve-coordination@incibe.esMedium 5.3
Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability could allow an attacker to modify a single email to contain upper and lower case characters in order to access the application and win prizes as many times as wanted.
- Product
- Wheel of fortune
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024Wheel of Life: Missing AuthorizationCVE-2024-47311 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through <= 1.1.8.
- Product
- Wheel of Life
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Wheel of Life to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Plum: Spin Wheel & Email Pop-up: Missing AuthorizationCVE-2024-38744 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS.This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0.
- Product
- Plum: Spin Wheel & Email Pop-up
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Plum: Spin Wheel & Email Pop-up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Plum: Spin Wheel & Email Pop-up: Access ControlCVE-2024-38743 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Access Control vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows . This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0.
- Product
- Plum: Spin Wheel & Email Pop-up
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Plum: Spin Wheel & Email Pop-up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2024Wheel of Life: Coaching and Assessment Tool for Life Coach: Unauthorized modification and loss of dataCVE-2024-3627 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts and modify settings.
- Product
- Wheel of Life: Coaching and Assessment Tool for Life Coach
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Wheel of Life: Coaching and Assessment Tool for Life Coach to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 19, 2024SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensitive information via CVE-2024-28389 · Other software · knowband · reported by MITRECritical 9.8
SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensitive information via the SpinWheelFrameSpinWheelModuleFrontController::sendEmail() method.
- Product
- spinwheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Jan 8, 2024WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51408 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce: from n/a through 1.4.3.
- Product
- WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 7, 2023Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel.CVE-2023-37066 · Other software · Chamilo · reported by MITREMedium 4.8
Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.chamilo.org
May 9, 2023Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.CVE-2023-31801 · Other software · Chamilo · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.
- Product
- Chamilo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
Dec 22, 2022An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled iCVE-2022-40898 · Other software · Wheel Project · reported by MITREHigh 7.5
An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.
- Product
- Wheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021MouseWheel Smooth Scroll: Does not have CSRF check in place on its settings pageCVE-2021-24852 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- MouseWheel Smooth Scroll
- Fixed in
- 5.7
- What to do
- Update MouseWheel Smooth Scroll to 5.7 or newer.
Sep 17, 2019The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.CVE-2016-10986 · WordPress plugins & themes · reported by MITREMedium 6.1
The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.
- Product
- tweet-wheel
- Fixed in
- 1.0.3.3
- What to do
- Update tweet-wheel to 1.0.3.3 or newer.
Full record and what to do →NVD record0x62626262.wordpress.comwordpress.org
Apr 20, 2019BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at btnseq.c.CVE-2019-11371 · Other software · Burrow-wheeler Aligner Project · reported by MITRECritical 9.8
BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at btnseq.c.
- Product
- Burrow-wheeler Aligner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2019BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt CVE-2019-10269 · Other software · Burrow-wheeler Aligner Project · reported by MITRECritical 9.8
BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.
- Product
- Burrow-wheeler Aligner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcoreymhudson.github.iogithub.com
Oct 19, 2014The PROF.CVE-2014-7134 · Other software · Skydreams · reported by cret@cert.orgMedium 5.4
The PROF. USMAN ALI AWHEELA (aka com.wPROFUAAWHEELA) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Prof. Usman ALI Awheela
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 16, 2013The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, alCVE-2013-2893 · Computers, phones & browsers · Linux · reported by chrome-cve-admin@google.comMedium 4.7
The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.