Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

485new WordPress flaws this week

392,772entries in the database

9,260 results · page 122 of 186

Dec 13, 2024DELUCKS SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54259 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
Product
DELUCKS SEO
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni CRM Lead: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54258 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows SQL Injection.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
Product
Ni CRM Lead
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Prodigy Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54250 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through <= 3.0.8.
Product
Prodigy Commerce
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Prodigy Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024FAQs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54246 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Stored XSS.This issue affects FAQs: from n/a through <= 1.0.2.
Product
FAQs
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update FAQs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54245 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through <= 1.1.4.
Product
Clients
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Easy Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54244 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Easy Replace easy-replace allows Stored XSS.This issue affects Easy Replace: from n/a through <= 1.3.
Product
Easy Replace
Affected
up to 1.3
What to do
Affects up to 1.3. Update Easy Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Echoza: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54243 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Echoza echoza allows Stored XSS.This issue affects Echoza: from n/a through <= 0.1.1.
Product
Echoza
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Echoza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Simple Notification: Missing AuthorizationCVE-2024-54242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in appsbd Simple Notification simple-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Notification: from n/a through <= 1.3.
Product
Simple Notification
Affected
up to 1.3
What to do
Affects up to 1.3. Update Simple Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Blaze Online eParcel for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54240 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through <= 1.3.3.
Product
Blaze Online eParcel for WooCommerce
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Blaze Online eParcel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Board Document Manager from CHUHPL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.This issue affects Board Document Manager from CHUHPL: from n/a through <= 1.9.1.
Product
Board Document Manager from CHUHPL
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Board Document Manager from CHUHPL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni CRM Lead: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54237 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows Reflected XSS.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
Product
Ni CRM Lead
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Ni CRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni WooCommerce Bulk Product Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54236 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocommerce-product-editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from n/a through <= 1.4.5.
Product
Ni WooCommerce Bulk Product Editor
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Ni WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Shiptimize for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54235 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-woocommerce allows Reflected XSS.This issue affects Shiptimize for WooCommerce: from n/a through <= 3.1.86.
Product
Shiptimize for WooCommerce
Affected
up to 3.1.86
What to do
Affects up to 3.1.86. Update Shiptimize for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Limit Login Attempts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54234 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.
Product
Limit Login Attempts
Affected
up to 5.5
What to do
Affects up to 5.5. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Advanced Control Manager for WordPress by ItalyStrap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54233 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Reflected XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through <= 2.16.0.
Product
Advanced Control Manager for WordPress by ItalyStrap
Affected
up to 2.16.0
What to do
Affects up to 2.16.0. Update Advanced Control Manager for WordPress by ItalyStrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Ni WooCommerce Order Export: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54231 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Order Export ni-woocommerce-order-export allows Reflected XSS.This issue affects Ni WooCommerce Order Export: from n/a through <= 3.1.6.
Product
Ni WooCommerce Order Export
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Ni WooCommerce Order Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Simple URLs: Missing AuthorizationCVE-2023-40678 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Andrew Fiebert Simple URLs simple-urls allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple URLs: from n/a through <= 117.
Product
Simple URLs
Affected
up to 117
What to do
Affects up to 117. Update Simple URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024MailChimp Forms by MailMunch: Missing AuthorizationCVE-2023-40203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailMunch MailChimp Forms by MailMunch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailChimp Forms by MailMunch: from n/a through 3.1.4.
Product
MailChimp Forms by MailMunch
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Simple Googlebot Visit: Missing AuthorizationCVE-2023-38479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Codents Simple Googlebot Visit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Googlebot Visit: from n/a through 1.2.4.
Product
Simple Googlebot Visit
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Simple Googlebot Visit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Simple Page Ordering: Missing AuthorizationCVE-2023-32798 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 10up Simple Page Ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Page Ordering: from n/a through 2.5.0.
Product
Simple Page Ordering
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Simple Page Ordering to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024The Simple Link Directory: Arbitrary shortcode executionCVE-2024-12417 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Simple Link Directory
Affected
up to 8.4.5
What to do
Affects up to 8.4.5. Update The Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 10, 2024Simple Restrict: Sensitive Information ExposureCVE-2024-11106 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
Simple Restrict
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Simple Restrict to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2024Team Member: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-52385 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpmart Team Member team-showcase-supreme.This issue affects Team Member: from n/a through <= 7.4.
Product
Team Member
Affected
up to 7.4
What to do
Affects up to 7.4. Update Team Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024News Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54260 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
Product
News Kit Elementor Addons
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Xpro Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54253 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.6.5.
Product
Xpro Elementor Addons
Affected
up to 1.4.6.5
What to do
Affects up to 1.4.6.5. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024ABCBiz Addons and Templates for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54247 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABCBiz ABCBiz Addons and Templates for Elementor allows Stored XSS.This issue affects ABCBiz Addons and Templates for Elementor: from n/a through 2.0.2.
Product
ABCBiz Addons and Templates for Elementor
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update ABCBiz Addons and Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024RRAddons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54232 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RRDevs RRAddons for Elementor rrdevs-for-elementor allows Stored XSS.This issue affects RRAddons for Elementor: from n/a through <= 1.1.0.
Product
RRAddons for Elementor
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update RRAddons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Unlock Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54230 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masud Hasan Unlock Addons for Elementor unlock-addons-for-elementor allows DOM-Based XSS.This issue affects Unlock Addons for Elementor: from n/a through <= 2.2.4.
Product
Unlock Addons for Elementor
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Unlock Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Wot Elementor Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54228 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Wot Elementor Widgets wot-elementor-widgets allows DOM-Based XSS.This issue affects Wot Elementor Widgets: from n/a through <= 1.0.1.
Product
Wot Elementor Widgets
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Wot Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Designer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-54225 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codegearthemes Designer designer allows PHP Local File Inclusion.This issue affects Designer: from n/a through <= 1.4.1.
Product
Designer
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024ElementsReady Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54224 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows DOM-Based XSS.This issue affects ElementsReady Addons for Elementor: from n/a through <= 6.4.7.
Product
ElementsReady Addons for Elementor
Affected
up to 6.4.7
What to do
Affects up to 6.4.7. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024ARForms Form Builder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-54223 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through <= 1.7.1.
Product
ARForms Form Builder
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024FAT Services Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54220 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Services Booking fat-services-booking allows Stored XSS.This issue affects FAT Services Booking: from n/a through <= 5.6.
Product
FAT Services Booking
Affected
up to 5.6
What to do
Affects up to 5.6. Update FAT Services Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024AIO Contact: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54219 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through <= 2.8.1.
Product
AIO Contact
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update AIO Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Revy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54215 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy.This issue affects Revy: from n/a through <= 1.18.
Product
Revy
Affected
up to 1.18
What to do
Affects up to 1.18. Update Revy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024PostX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53818 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.15.
Product
PostX
Affected
up to 4.1.15
What to do
Affects up to 4.1.15. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Lenxel Core for Lenxel(LNX) LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53791 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows DOM-Based XSS.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.
Product
Lenxel Core for Lenxel(LNX) LMS
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Lenxel Core for Lenxel(LNX) LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Lenxel Core for Lenxel(LNX) LMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-53790 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PHP Local File Inclusion.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.
Product
Lenxel Core for Lenxel(LNX) LMS
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Lenxel Core for Lenxel(LNX) LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024WP Simple HTML Sitemap: Missing AuthorizationCVE-2023-49850 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through 2.7.
Product
WP Simple HTML Sitemap
Affected
up to 2.7
What to do
Affects up to 2.7. Update WP Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Importify (Dropshipping WooCommerce): Insertion of Sensitive Information Into Debugging CodeCVE-2023-49194 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Debugging Code vulnerability in importify Importify (Dropshipping WooCommerce) importify allows Retrieve Embedded Sensitive Data.This issue affects Importify (Dropshipping WooCommerce): from n/a through <= 1.0.4.
Product
Importify (Dropshipping WooCommerce)
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Importify (Dropshipping WooCommerce) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024LadiApp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49158 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binh Nguyen LadiApp ladipage allows Stored XSS.This issue affects LadiApp: from n/a through <= 4.4.
Product
LadiApp
Affected
up to 4.4
What to do
Affects up to 4.4. Update LadiApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024wpForo Forum: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-47869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affects wpForo Forum: from n/a through 2.2.5.
Product
wpForo Forum
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Simple 301 Redirects by BetterLinks: Missing AuthorizationCVE-2023-47761 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks simple-301-redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple 301 Redirects by BetterLinks: from n/a through <= 2.0.7.
Product
Simple 301 Redirects by BetterLinks
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Simple 301 Redirects by BetterLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Easy Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-30748 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikola Loncar Easy Appointments allows Stored XSS.This issue affects Easy Appointments: from n/a through 3.10.7.
Product
Easy Appointments
Affected
up to 3.10.7
What to do
Affects up to 3.10.7. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024qTranslate X Cleanup and WPML Import: Missing AuthorizationCVE-2023-29431 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in OntheGoSystems qTranslate X Cleanup and WPML Import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects qTranslate X Cleanup and WPML Import: from n/a through 3.0.1.
Product
qTranslate X Cleanup and WPML Import
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update qTranslate X Cleanup and WPML Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Simple Giveaways: Missing AuthorizationCVE-2023-23893 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Igor Benic Simple Giveaways allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Giveaways: from n/a through 2.48.0.
Product
Simple Giveaways
Affected
up to 2.48.0
What to do
Affects up to 2.48.0. Update Simple Giveaways to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 7, 2024Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal: Unauthorized accessCVE-2024-12253 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the plugins settings and retrieve order and log data (which is also accessible to unauthenticated users).
Product
Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 7, 2024Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal: Reflected Cross-Site ScriptingCVE-2024-12128 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘monthly_sales_current_year’ parameter in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 7, 2024Simple Side Tab: Does not sanitise and escape some of its settingsCVE-2024-11183 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple Side Tab
Fixed in
2.2.0
What to do
Update Simple Side Tab to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Dec 6, 2024ZionBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54213 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zionbuilder ZionBuilder zionbuilder allows Stored XSS.This issue affects ZionBuilder: from n/a through <= 3.6.16.
Product
ZionBuilder
Affected
up to 3.6.16
What to do
Affects up to 3.6.16. Update ZionBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.