Updated 26 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

495new WordPress flaws this week

393,009entries in the database

9,116 results · page 125 of 183

Jul 12, 2024Premium Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-6495 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Premium Addons for Elementor
Affected
up to 4.10.36
What to do
Affects up to 4.10.36. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2024MStore API – Create Native Android & iOS Apps On The Cloud: Authentication bypassCVE-2024-6328 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_login' and 'firebase_sms_login_v2' functions. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email address or phone number. Additionally, if a new email address is supplied, a new user account is created with the default role, even if registration is disabled.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.14.7
What to do
Affects up to 4.14.7. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2024WP Total Branding – Complete branding solution for: Stored Cross-Site ScriptingCVE-2024-6625 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP Total Branding – Complete branding solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Total Branding – Complete branding solution for
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP Total Branding – Complete branding solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2024Simple Video Directory: Does not sanitise and escape some of its settingsCVE-2024-5811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Video Directory WordPress plugin before 1.4.4 does not sanitise and escape some of its settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Simple Video Directory
Fixed in
1.4.4
What to do
Update Simple Video Directory to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2024Feeds for YouTube (YouTube video, channel, and gallery plugin): Stored Cross-Site ScriptingCVE-2024-6256 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Feeds for YouTube (YouTube video, channel, and gallery plugin)
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Feeds for YouTube (YouTube video, channel, and gallery plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2024Duplicator: Information exposureCVE-2024-6210 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Duplicator plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
Product
Duplicator
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2024FULL – Cliente: Stored Cross-Site ScriptingCVE-2024-6447 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FULL – Cliente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the license plan parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping as well as missing authorization and capability checks on the related functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrative user accesses wp-admin dashboard
Product
FULL – Cliente
Affected
up to 3.1.12
What to do
Affects up to 3.1.12. Update FULL – Cliente to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2024FileBird Document Library: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37504 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library: from n/a through 2.0.6.
Product
FileBird Document Library
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update FileBird Document Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024Table & Contact Form 7 Database – Tablesome: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.33.
Product
Table & Contact Form 7 Database – Tablesome
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update Table & Contact Form 7 Database – Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024Newspack Blocks: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37115 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0.8.
Product
Newspack Blocks
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37113 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37110 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Stored Cross-Site ScriptingCVE-2024-5664 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaar_audioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Affected
up to 5.5
What to do
Affects up to 5.5. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Featured Image Generator: Unauthorized image uploadCVE-2024-5677 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the fig_save_after_generate_image function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary images to a post-related gallery.
Product
Featured Image Generator
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Featured Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress CVE-2024-4866 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37554 is potentially a duplicate of this.
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Advanced File Manager Shortcodes: Directory TraversalCVE-2023-7062 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Advanced File Manager Shortcodes
Affected
up to 2.4
What to do
Affects up to 2.4. Update Advanced File Manager Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advancedfilemanager.com wordfence.com
Jul 9, 2024ShopBuilder – Elementor WooCommerce Builder Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-37520 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 2.1.12.
Product
ShopBuilder – Elementor WooCommerce Builder Addons
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024WPCafe: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37513 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPCafe: from n/a through 2.2.27.
Product
WPCafe
Affected
up to 2.2.27
What to do
Affects up to 2.2.27. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024oik: Stored Cross-Site ScriptingCVE-2024-6391 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bw_button shortcode in all versions up to, and including, 4.10.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
oik
Affected
up to 4.10.3
What to do
Affects up to 4.10.3. Update oik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Advanced Classifieds & Directory Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37501 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Traversal.This issue affects Advanced Classifieds & Directory Pro: from n/a through 3.1.3.
Product
Advanced Classifieds & Directory Pro
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37499 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Path Traversal.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.2.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024JetThemeCore: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37497 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetThemeCore jet-theme-core.This issue affects JetThemeCore: from n/a through < 2.2.1.
Product
JetThemeCore
What to do
Update JetThemeCore to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Beaver Builder Addons by WPZOOM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37464 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.This issue affects Beaver Builder Addons by WPZOOM: from n/a through 1.3.5.
Product
Beaver Builder Addons by WPZOOM
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Squelch Tabs and Accordions Shortcodes: Stored Cross-Site ScriptingCVE-2024-5946 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tab’ shortcode in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Squelch Tabs and Accordions Shortcodes
Affected
up to 0.4.8
What to do
Affects up to 0.4.8. Update Squelch Tabs and Accordions Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024WPBITS Addons For Elementor Page Builder: Stored Cross-Site ScriptingCVE-2024-4862 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37945 may be a duplicate of this issue.
Product
WPBITS Addons For Elementor Page Builder
Affected
up to 1.5
What to do
Affects up to 1.5. Update WPBITS Addons For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Ultimate Bootstrap Elements for Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37462 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows Path Traversal.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.2.
Product
Ultimate Bootstrap Elements for Elementor
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Ultimate Bootstrap Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Ultimate Addons for Elementor: Improper Privilege ManagementCVE-2024-37455 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31.
Product
Ultimate Addons for Elementor
Affected
up to 1.36.31
What to do
Affects up to 1.36.31. Update Ultimate Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024AWSM Team: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AWSM Innovations AWSM Team allows Path Traversal.This issue affects AWSM Team: from n/a through 1.3.1.
Product
AWSM Team
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update AWSM Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37437 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor.This issue affects Elementor Website Builder: from n/a through <= 3.22.1.
Product
Elementor Website Builder
Affected
up to 3.22.1
What to do
Affects up to 3.22.1. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Zita Elementor Site Library: Unrestricted Upload of File with Dangerous TypeCVE-2024-37420 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affects Zita Elementor Site Library: from n/a through 1.6.1.
Product
Zita Elementor Site Library
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Zita Elementor Site Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Cowidgets – Elementor Addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37419 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Codeless Cowidgets – Elementor Addons allows Path Traversal.This issue affects Cowidgets – Elementor Addons: from n/a through 1.1.1.
Product
Cowidgets – Elementor Addons
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Cowidgets – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Striking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37268 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kaptinlin Striking allows Path Traversal.This issue affects Striking: from n/a through 2.3.4.
Product
Striking
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Striking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Tutor LMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37266 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1.
Product
Tutor LMS
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024WP Directory Kit: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CVE-2024-37253 · WordPress plugins & themes · reported by PatchstackLow 2.7
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6.
Product
WP Directory Kit
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024SP Project & Document Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37224 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.71.
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Masterstudy Elementor Widgets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37090 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThemes Consulting Elementor Widgets.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2; Consulting Elementor Widgets: from n/a through 1.3.0.
Product
Masterstudy Elementor Widgets
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Simple Alert Boxes: Stored Cross-Site ScriptingCVE-2024-5937 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Alert Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert shortcode in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Alert Boxes
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Simple Alert Boxes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue: Stored Cross-Site ScriptingCVE-2024-5600 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check and insufficient sanitization on the import_settings() function in all versions up to, and including, 1.3.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts.
Product
SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Easy Pixels: Stored Cross-Site ScriptingCVE-2024-5479 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Easy Pixels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Pixels
Affected
up to 2.13
What to do
Affects up to 2.13. Update Easy Pixels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Panda Video: Stored Cross-Site ScriptingCVE-2024-5457 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Panda Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Panda Video
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Panda Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Extensions for Elementor: Stored Cross-Site ScriptingCVE-2024-4868 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox widgets in all versions up to, and including, 2.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Extensions for Elementor
Affected
up to 2.0.32
What to do
Affects up to 2.0.32. Update Extensions for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024OSM – OpenStreetMap: Stored Cross-Site ScriptingCVE-2024-3603 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osm_map' shortcode in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
OSM – OpenStreetMap
Affected
up to 6.0.3
What to do
Affects up to 6.0.3. Update OSM – OpenStreetMap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 9, 2024Genesis Blocks: Stored Cross-Site ScriptingCVE-2024-3563 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-3901 is a duplicate of this issue.
Product
Genesis Blocks
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Genesis Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37256 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1.
Product
Tutor LMS
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Webico Slider Flatsome Addons: Stored Cross-Site ScriptingCVE-2024-5881 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Webico Slider Flatsome Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wbc_image shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Webico Slider Flatsome Addons
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Webico Slider Flatsome Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): IP Address SpoofingCVE-2024-6171 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass antispam functionality in the Form Builder widgets.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.112
What to do
Affects up to 1.5.112. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Stored Cross-Site ScriptingCVE-2024-6170 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘email’ parameter in all versions up to, and including, 1.5.112 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.112
What to do
Affects up to 1.5.112. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jul 9, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Stored Cross-Site ScriptingCVE-2024-6169 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.5.112 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above and granted plugin setting edit permissions by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.112
What to do
Affects up to 1.5.112. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jul 9, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Time-based SQL InjectionCVE-2024-6166 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above and granted plugin setting edit permissions by an administrator, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.112
What to do
Affects up to 1.5.112. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Blog, Posts and Category Filter for Elementor: Stored Cross-Site ScriptingCVE-2024-4667 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Blog, Posts and Category Filter for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post and Category Filter widget in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied 'post_types' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Blog, Posts and Category Filter for Elementor
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Blog, Posts and Category Filter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.