Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,153 results · page 13 of 24
Dec 18, 2024WPLMS: Unrestricted Upload of File with Dangerous TypeCVE-2024-56057 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.2
- What to do
- Update WPLMS to 1.9.9.5.2 or newer.
Dec 18, 2024WPLMS: Unrestricted Upload of File with Dangerous TypeCVE-2024-56054 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.2
- What to do
- Update WPLMS to 1.9.9.5.2 or newer.
Dec 18, 2024WPLMS: Unrestricted Upload of File with Dangerous TypeCVE-2024-56052 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.2
- What to do
- Update WPLMS to 1.9.9.5.2 or newer.
Dec 18, 2024WPLMS: Unrestricted Upload of File with Dangerous TypeCVE-2024-56050 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.3
- What to do
- Update WPLMS to 1.9.9.5.3 or newer.
Dec 18, 2024Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Sensitive Information ExposureCVE-2024-11291 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
- Product
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- Affected
- up to 2.13.4
- What to do
- Affects up to 2.13.4. Update Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 18, 2024Simple Page Access Restriction: Sensitive Information ExposureCVE-2024-11295 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.29 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
- Product
- Simple Page Access Restriction
- Affected
- up to 1.0.29
- What to do
- Affects up to 1.0.29. Update Simple Page Access Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 17, 2024s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Sensitive Information ExposureCVE-2024-8326 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 241114 via the 'sc_get_details' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including user data and database configuration information, which can lead to reading, updating, or dropping database tables. The vulnerability was partially patched in version 241114.
- Product
- s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
- Affected
- up to 241114
- What to do
- Affects up to 241114. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2024SeedProd Pro: Unrestricted Upload of File with Dangerous TypeCVE-2024-54285 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedProd Pro: from n/a through 6.18.10.
- Product
- SeedProd Pro
- Affected
- up to 6.18.10
- What to do
- Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Bold Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54382 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Traversal.This issue affects Bold Page Builder: from n/a through <= 5.1.5.
- Product
- Bold Page Builder
- Affected
- up to 5.1.5
- What to do
- Affects up to 5.1.5. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP Cookies Enabler: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54380 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Filippo Bodei WP Cookies Enabler wp-cookies-enabler allows PHP Local File Inclusion.This issue affects WP Cookies Enabler: from n/a through <= 1.0.1.
- Product
- WP Cookies Enabler
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Cookies Enabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Woolook: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54375 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Woolook woolook allows PHP Local File Inclusion.This issue affects Woolook: from n/a through <= 1.7.0.
- Product
- Woolook
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Woolook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Sogrid: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54374 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Sogrid sogrid allows PHP Local File Inclusion.This issue affects Sogrid: from n/a through <= 1.5.6.
- Product
- Sogrid
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Sogrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024EduAdmin Booking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54373 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chris Gardenberg EduAdmin Booking eduadmin-booking allows PHP Local File Inclusion.This issue affects EduAdmin Booking: from n/a through <= 5.2.0.
- Product
- EduAdmin Booking
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update EduAdmin Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Video & Photo Gallery for Ultimate Member: Unrestricted Upload of File with Dangerous TypeCVE-2024-54370 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Upload a Web Shell to a Web Server.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.0.
- Product
- Video & Photo Gallery for Ultimate Member
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Import Export For WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2024-54262 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.
- Product
- Import Export For WooCommerce
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Import Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024DELUCKS SEO: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54259 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
- Product
- DELUCKS SEO
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WooCommerce Predictive Search: Missing AuthorizationCVE-2023-32963 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in a3rev Software WooCommerce Predictive Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Predictive Search: from n/a through 5.8.0.
- Product
- WooCommerce Predictive Search
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update WooCommerce Predictive Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Depicter Slider: Missing AuthorizationCVE-2022-47176 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0.
- Product
- Depicter Slider
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Membership Plan settingsCVE-2024-10518 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.15
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.15 or newer.
Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Drag & Drop Builder fieldsCVE-2024-10517 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.15
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.15 or newer.
Dec 11, 2024Restrict – membership, site, content and user access restrictions for: Sensitive Information ExposureCVE-2024-11351 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.8 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
- Product
- Restrict – membership, site, content and user access restrictions for
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Restrict – membership, site, content and user access restrictions for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 10, 2024Simple Restrict: Sensitive Information ExposureCVE-2024-11106 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
- Product
- Simple Restrict
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Simple Restrict to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2024Pie Register Premium: Unrestricted Upload of File with Dangerous TypeCVE-2024-53822 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.
- Product
- Pie Register Premium
- Fixed in
- 3.8.3.3
- What to do
- Update Pie Register Premium to 3.8.3.3 or newer.
Dec 9, 2024Lenxel Core for Lenxel(LNX) LMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-53790 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PHP Local File Inclusion.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.
- Product
- Lenxel Core for Lenxel(LNX) LMS
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Lenxel Core for Lenxel(LNX) LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Revy: Unrestricted Upload of File with Dangerous TypeCVE-2024-54214 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in roninwp Revy revy allows Upload a Web Shell to a Web Server.This issue affects Revy: from n/a through <= 1.18.
- Product
- Revy
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Revy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WDesignkit: Unrestricted Upload of File with Dangerous TypeCVE-2024-53811 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Unrestricted Upload of File with Dangerous Type vulnerability in POSIMYTH WDesignkit wdesignkit allows Upload a Web Shell to a Web Server.This issue affects WDesignkit: from n/a through <= 1.0.40.
- Product
- WDesignkit
- Affected
- up to 1.0.40
- What to do
- Affects up to 1.0.40. Update WDesignkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Slider and Carousel slider by Depicter: Stored Cross-Site ScriptingCVE-2024-4633 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘addExtraMimeType’ function in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Slider and Carousel slider by Depicter
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Slider and Carousel slider by Depicter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2024The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: Arbitrary shortcode executionCVE-2024-10681 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.0.51. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
- Affected
- up to 4.0.51
- What to do
- Affects up to 4.0.51. Update The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 4, 2024The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login pCVE-2024-11293 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
- Affected
- up to 1.7.9
- What to do
- Affects up to 1.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpieregister.comwordfence.com
Dec 2, 2024Fediverse Embeds: Unrestricted Upload of File with Dangerous TypeCVE-2024-52476 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Stefan Bohacek Fediverse Embeds fediverse-embeds allows Upload a Web Shell to a Web Server.This issue affects Fediverse Embeds: from n/a through <= 1.5.3.
- Product
- Fediverse Embeds
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Fediverse Embeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Pathomation: Unrestricted Upload of File with Dangerous TypeCVE-2024-52490 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through <= 2.5.1.
- Product
- Pathomation
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Pathomation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Jobify: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52481 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Astoundify Jobify jobify allows Relative Path Traversal.This issue affects Jobify: from n/a through < 4.3.0.
- Product
- Jobify
- Fixed in
- 4.2.4
- What to do
- Update Jobify to 4.2.4 or newer.
Nov 21, 2024Anonymous Restricted Content: Sensitive Information ExposureCVE-2024-11089 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to logged-in users.
- Product
- Anonymous Restricted Content
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Anonymous Restricted Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 21, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Unauthorized profile picture updatesCVE-2024-10528 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a missing capability check on the wp_ajax_um_resize_image() and ajax_resize_image() functions in all versions up to, and including, 2.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the profile pictures of other users.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.9
- What to do
- Affects up to 2.8.9. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Bootscraper: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52449 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Navneil Naicer Bootscraper allows PHP Local File Inclusion.This issue affects Bootscraper: from n/a through 2.1.0.
- Product
- Bootscraper
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Bootscraper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Ultimate Classified Listings: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52448 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Opal Woo Custom Product Variation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52444 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through <= 1.1.3.
- Product
- Opal Woo Custom Product Variation
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Opal Woo Custom Product Variation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024WP Quick Setup: Unrestricted Upload of File with Dangerous TypeCVE-2024-52429 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in AntonHoelstad WP Quick Setup wp-quick-setup allows Upload a Web Shell to a Web Server.This issue affects WP Quick Setup: from n/a through <= 2.0.
- Product
- WP Quick Setup
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WP Quick Setup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Convert Docx2post: Unrestricted Upload of File with Dangerous TypeCVE-2024-52397 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Davor Zeljkovic Convert Docx2post convert-docx2post allows Upload a Web Shell to a Web Server.This issue affects Convert Docx2post: from n/a through <= 1.4.
- Product
- Convert Docx2post
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Convert Docx2post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Push Notifications for WordPress by PushAssist: Unrestricted Upload of File with Dangerous TypeCVE-2024-52408 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in pushassist Push Notifications for WordPress by PushAssist push-notification-for-wp-by-pushassist allows Upload a Web Shell to a Web Server.This issue affects Push Notifications for WordPress by PushAssist: from n/a through <= 3.0.8.
- Product
- Push Notifications for WordPress by PushAssist
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Push Notifications for WordPress by PushAssist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024BasePress Migration Tools: Unrestricted Upload of File with Dangerous TypeCVE-2024-52407 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in BasePress BasePress Migration Tools basepress-migration-tools allows Upload a Web Shell to a Web Server.This issue affects BasePress Migration Tools: from n/a through <= 1.0.0.
- Product
- BasePress Migration Tools
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update BasePress Migration Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024CSV to html: Unrestricted Upload of File with Dangerous TypeCVE-2024-52406 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in wibergsweb CSV to html csv-to-html allows Upload a Web Shell to a Web Server.This issue affects CSV to html: from n/a through <= 3.26.
- Product
- CSV to html
- Affected
- up to 3.26
- What to do
- Affects up to 3.26. Update CSV to html to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024B-Banner Slider: Unrestricted Upload of File with Dangerous TypeCVE-2024-52405 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in bikramjoshii B-Banner Slider b-banner-slider allows Upload a Web Shell to a Web Server.This issue affects B-Banner Slider: from n/a through <= 1.1.
- Product
- B-Banner Slider
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update B-Banner Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024CF7 Reply Manager: Unrestricted Upload of File with Dangerous TypeCVE-2024-52404 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in bigfiveagency CF7 Reply Manager cf7-reply-manager.This issue affects CF7 Reply Manager: from n/a through <= 1.2.3.
- Product
- CF7 Reply Manager
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update CF7 Reply Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024User Management: Unrestricted Upload of File with Dangerous TypeCVE-2024-52403 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Saad Iqbal User Management user-management allows Upload a Web Shell to a Web Server.This issue affects User Management: from n/a through <= 1.1.
- Product
- User Management
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Gallerio: Unrestricted Upload of File with Dangerous TypeCVE-2024-52400 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Subhasis Laha Gallerio gallerio allows Upload a Web Shell to a Web Server.This issue affects Gallerio: from n/a through <= 1.01.
- Product
- Gallerio
- Affected
- up to 1.01
- What to do
- Affects up to 1.01. Update Gallerio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Writer Helper: Unrestricted Upload of File with Dangerous TypeCVE-2024-52399 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Clarisse K. Writer Helper writer-helper allows Upload a Web Shell to a Web Server.This issue affects Writer Helper: from n/a through <= 3.1.6.
- Product
- Writer Helper
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Writer Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024CDI: Unrestricted Upload of File with Dangerous TypeCVE-2024-52398 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Halyra CDI collect-and-deliver-interface-for-woocommerce.This issue affects CDI: from n/a through <= 5.5.3.
- Product
- CDI
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update CDI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Hive Support: Unrestricted Upload of File with Dangerous TypeCVE-2024-52370 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Hive Support Hive Support hive-support allows Upload a Web Shell to a Web Server.This issue affects Hive Support: from n/a through <= 1.1.1.
- Product
- Hive Support
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024KBucket: Unrestricted Upload of File with Dangerous TypeCVE-2024-52369 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Optimal Access KBucket kbucket allows Upload a Web Shell to a Web Server.This issue affects KBucket: from n/a through <= 4.2.2.
- Product
- KBucket
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update KBucket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.