Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

783 results · page 10 of 16

Aug 24, 2024Image Hotspot by DevVN: PHP Object InjectionCVE-2024-7656 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deserialization of untrusted input in the 'devvn_ihotspot_shortcode_func' function. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Image Hotspot by DevVN
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Image Hotspot by DevVN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 23, 2024ImageRecycle pdf & image compression: Cross-Site Request ForgeryCVE-2024-8120 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This makes it possible for unauthenticated attackers to update plugin settings along with performing other actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-6631 · WordPress plugins & themes · reported by WordfenceMedium 5
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions, such as updating plugin settings.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 17, 2024Slideshow, Image Slider by 2J: Reflected Cross-Site ScriptingCVE-2023-4604 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Slideshow, Image Slider by 2J plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘post’ parameter in versions up to, and including, 1.3.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Slideshow, Image Slider by 2J
Affected
up to 1.3.54
What to do
Affects up to 1.3.54. Update Slideshow, Image Slider by 2J to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 13, 2024Generate Images: Does not sanitise and escape some of its settingsCVE-2024-6724 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Generate Images WordPress plugin before 5.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Generate Images
Fixed in
5.2.8
What to do
Update Generate Images to 5.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 20243D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43152 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery allows Stored XSS.This issue affects 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery: from n/a through 1.15.6.
Product
3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery
Affected
up to 1.15.6
What to do
Affects up to 1.15.6. Update 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 8, 2024Slider by 10Web – Responsive Image Slider: Time-based SQL InjectionCVE-2024-7150 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Slider by 10Web – Responsive Image Slider plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.2.57 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Slider by 10Web – Responsive Image Slider
Affected
up to 1.2.57
What to do
Affects up to 1.2.57. Update Slider by 10Web – Responsive Image Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Stored Cross-Site ScriptingCVE-2024-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the Gallery title field in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2024Optimize Images ALT Text (alt tag) & names for SEO using AI: Full Path DisclosureCVE-2024-6571 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.1. This is due the plugin utilizing cocur and not preventing direct access to the generate-default.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Optimize Images ALT Text (alt tag) & names for SEO using AI
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Optimize Images ALT Text (alt tag) & names for SEO using AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 22, 2024Transition Slider – Responsive Image Slider and Gallery: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37215 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in creativeinteractivemedia Transition Slider – Responsive Image Slider and Gallery allows Stored XSS.This issue affects Transition Slider – Responsive Image Slider and Gallery: from n/a through 2.20.3.
Product
Transition Slider – Responsive Image Slider and Gallery
Affected
up to 2.20.3
What to do
Affects up to 2.20.3. Update Transition Slider – Responsive Image Slider and Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 16, 2024Image Hover Effects – Elementor Addon: Stored Cross-Site ScriptingCVE-2024-4780 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihe_link’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Hover Effects – Elementor Addon
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Image Hover Effects – Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2024Image Photo Gallery Final Tiles Grid: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-3710 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Product
Image Photo Gallery Final Tiles Grid
Fixed in
3.6.0
What to do
Update Image Photo Gallery Final Tiles Grid to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Smart Image Gallery: Does not have CSRF check in placeCVE-2024-3632 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Smart Image Gallery
Fixed in
1.0.19
What to do
Update Smart Image Gallery to 1.0.19 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Quotes and Tips by BestWebSoft: Does not properly validate image files uploadedCVE-2024-3112 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
Quotes and Tips by BestWebSoft
Fixed in
1.45
What to do
Update Quotes and Tips by BestWebSoft to 1.45 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2024Image Optimizer, Resizer and CDN – Sirv: Unauthorized plugin settings modificationCVE-2024-6392 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.7
What to do
Affects up to 7.2.7. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Featured Image Generator: Unauthorized image uploadCVE-2024-5677 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the fig_save_after_generate_image function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary images to a post-related gallery.
Product
Featured Image Generator
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Featured Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Comment Images Reloaded: Unauthorized loss of dataCVE-2024-5856 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cir_delete_image AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary media attachments.
Product
Comment Images Reloaded
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Comment Images Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 8, 2024Media Hygiene: Remove or Delete Unused Images and More!: Unauthorized loss of dataCVE-2024-5855 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the bulk_action_delete and delete_single_image_call AJAX actions in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments. A nonce check was added in version 3.0.1, however, it wasn't until version 3.0.2 that a capability check was added.
Product
Media Hygiene: Remove or Delete Unused Images and More!
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Media Hygiene: Remove or Delete Unused Images and More! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 6, 2024Image Hover Effects - Caption Hover with Carousel: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37546 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Image Hover Effects - Caption Hover with Carousel allows Stored XSS.This issue affects Image Hover Effects - Caption Hover with Carousel: from n/a through 3.0.2.
Product
Image Hover Effects - Caption Hover with Carousel
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Image Hover Effects - Caption Hover with Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 6, 2024Responsive Image Gallery, Gallery Album: Missing AuthorizationCVE-2024-37542 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Product
Responsive Image Gallery, Gallery Album
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 28, 2024Easy Image Collage: Unauthorized loss of dataCVE-2024-5863 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Easy Image Collage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_image_collage() function in all versions up to, and including, 1.13.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to erase all of the content in arbitrary posts.
Product
Easy Image Collage
Affected
up to 1.13.5
What to do
Affects up to 1.13.5. Update Easy Image Collage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 27, 2024Portfolio Gallery – Image Gallery: Stored Cross-Site ScriptingCVE-2024-6262 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Portfolio Gallery – Image Gallery Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PFG' shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Portfolio Gallery – Image Gallery
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Portfolio Gallery – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2024Auto Featured Image: Arbitrary file uploadsCVE-2024-6054 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post_attachment_from_url' function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Auto Featured Image
Affected
up to 1.2
What to do
Affects up to 1.2. Update Auto Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 21, 2024DImage 360: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35774 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in D’arteweb DImage 360 allows Stored XSS.This issue affects DImage 360: from n/a through 2.0.
Product
DImage 360
Affected
up to 2.0
What to do
Affects up to 2.0. Update DImage 360 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024WP SVG Images: Stored Cross-Site ScriptingCVE-2024-5945 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissions to upload sanitized files, to bypass SVG sanitization and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A bypass to the patch in version 4.3 was discovered and fixed completely in version 4.4.
Product
WP SVG Images
Affected
up to 4.3
What to do
Affects up to 4.3. Update WP SVG Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Stored Cross-Site ScriptingCVE-2024-3894 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an Image Title in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Image Optimizer, Resizer and CDN – Sirv: Arbitrary file uploadsCVE-2024-5853 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirv_upload_file_by_chanks AJAX action in all versions up to, and including, 7.2.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.6
What to do
Affects up to 7.2.6. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Cross-Site Request ForgeryCVE-2024-5343 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.19. This is due to missing or incorrect nonce validation on the 'rbs_ajax_create_article' and 'rbs_ajax_reset_views' functions. This makes it possible for unauthenticated attackers to create new posts and reset gallery view counts via a forged request granted they can trick a Contributor+ level user into performing an action such as clicking on a link.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Replace Image: Insecure Direct Object ReferenceCVE-2024-4873 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Replace Image plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.10 via the image replacement functionality due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace images uploaded by higher level users such as admins.
Product
Replace Image
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Replace Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 18, 2024Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium: Does not sanitise and escape some of its settingsCVE-2024-3276 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium
Fixed in
2.7.28
What to do
Update Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium to 2.7.28 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2024Highcompress Image Compressor: Missing AuthorizationCVE-2023-40209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Himalaya Saxena Highcompress Image Compressor.This issue affects Highcompress Image Compressor: from n/a through 6.0.0.
Product
Highcompress Image Compressor
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update Highcompress Image Compressor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Slider Responsive Slideshow – Image slider, Gallery slideshow: Missing AuthorizationCVE-2024-35722 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: from n/a through 1.4.0.
Product
Slider Responsive Slideshow – Image slider, Gallery slideshow
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Slider Responsive Slideshow – Image slider, Gallery slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: Missing AuthorizationCVE-2024-35721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through 1.4.5.
Product
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Responsive Image Gallery, Gallery Album: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-35750 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Product
Responsive Image Gallery, Gallery Album
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 7, 2024Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Path TraversalCVE-2024-5481 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) the contents of arbitrary files on the server, which can contain sensitive information, and to cut (delete) arbitrary directories, including the root WordPress directory. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery edit permissions to lower level users, which might make this exploitable by users as low as contributors.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.23
What to do
Affects up to 1.8.23. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2024Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2024-5426 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Photo Gallery can be extended to contributors on pro versions of the plugin.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.23
What to do
Affects up to 1.8.23. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024Simple Image Popup Shortcode: Stored Cross-Site ScriptingCVE-2024-5342 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Image Popup Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sips_popup' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Image Popup Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple Image Popup Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 5, 2024Image Hover Effects for Elementor with Lightbox and Flipbox: Stored Cross-Site ScriptingCVE-2024-5001 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_id', 'oxi_addons_f_title_tag', and 'content_description_tag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37546 may be a duplicate of this issue.
Product
Image Hover Effects for Elementor with Lightbox and Flipbox
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Image Hover Effects for Elementor with Lightbox and Flipbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2024The Album and Image Gallery plus Lightbox: Arbitrary shortcode executionCVE-2024-4194 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Album and Image Gallery plus Lightbox
Affected
up to 2.0
What to do
Affects up to 2.0. Update The Album and Image Gallery plus Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 3, 2024ImageMagick Sharpen Resized Images: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-34790 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hans van Eijsden,niwreg ImageMagick Sharpen Resized Images allows Stored XSS.This issue affects ImageMagick Sharpen Resized Images: from n/a through 1.1.7.
Product
ImageMagick Sharpen Resized Images
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update ImageMagick Sharpen Resized Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 1, 2024QQWorld Auto Save Images: Unauthorized access of dataCVE-2024-1324 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The QQWorld Auto Save Images plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the save_remote_images_get_auto_saved_results() function hooked via a norpriv AJAX in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to retrieve the contents of arbitrary posts that may not be public.
Product
QQWorld Auto Save Images
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update QQWorld Auto Save Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 31, 2024Auto Featured Image (Auto Post Thumbnail): Server-Side Request ForgeryCVE-2023-7073 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.7 via the upload_to_library AJAX action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Auto Featured Image (Auto Post Thumbnail)
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 17, 2024Instant Images: Improper Privilege ManagementCVE-2024-33569 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Privilege Management vulnerability in Darren Cooney Instant Images allows Privilege Escalation.This issue affects Instant Images: from n/a through 6.1.0.
Product
Instant Images
Affected
up to 6.1.0
What to do
Affects up to 6.1.0. Update Instant Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2024Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF: Stored Cross-Site ScriptingCVE-2024-4636 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘allow_meme_types’ function in versions up to, and including, 3.12.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF
Affected
up to 3.12.10
What to do
Affects up to 3.12.10. Update Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024Alt Text AI – Automatically generate image alt text for SEO and accessibility: Generic SQL InjectionCVE-2024-4847 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘last_post_id’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Alt Text AI – Automatically generate image alt text for SEO and accessibility
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Alt Text AI – Automatically generate image alt text for SEO and accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024WP Compress – Image Optimizer [All-In-One]: Unauthorized modification of dataCVE-2024-4445 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting, in multisite environments.
Product
WP Compress – Image Optimizer [All-In-One]
Affected
up to 6.20.01
What to do
Affects up to 6.20.01. Update WP Compress – Image Optimizer [All-In-One] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024WP Compress – Image Optimizer [All-In-One: Open RedirectCVE-2023-6812 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
WP Compress – Image Optimizer [All-In-One
Affected
up to 6.20.01
What to do
Affects up to 6.20.01. Update WP Compress – Image Optimizer [All-In-One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024ShortPixel Adaptive Images: Cross-Site Request Forgery (CSRF)CVE-2024-4689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.
Product
ShortPixel Adaptive Images
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024ShortPixel Adaptive Images: Server-Side Request Forgery (SSRF)CVE-2024-35172 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.
Product
ShortPixel Adaptive Images
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Image Hover Effects – Elementor Addon: Stored Cross-Site ScriptingCVE-2024-1166 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hover Effects Widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Hover Effects – Elementor Addon
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Image Hover Effects – Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.