Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,714entries in the database

1,740 results · page 13 of 35

Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26362 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26361 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.1
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an uCVE-2025-26360 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.3
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to delete dashboards via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26359 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MCVE-2025-26348 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenCVE-2025-26347 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-FCVE-2025-26346 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenCVE-2025-26345 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unCVE-2025-26344 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable passwordless guest mode via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26342 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26341 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.
Product
MaxTime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nozominetworks.com
Feb 7, 2025Simple User Profile: Cross-Site Request Forgery (CSRF)CVE-2025-25140 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through <= 1.9.
Product
Simple User Profile
Affected
up to 1.9
What to do
Affects up to 1.9. Update Simple User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 5, 2025When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosedCVE-2025-24312 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com
Feb 5, 2025When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate.CVE-2025-23412 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com
Feb 5, 2025When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop proCVE-2025-22891 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com
Feb 5, 2025When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management MicrokernCVE-2025-22846 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com
Feb 5, 2025When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memCVE-2025-21087 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.9
When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com
Feb 5, 2025When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization.CVE-2025-20058 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.9
When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com
Feb 5, 2025When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virCVE-2025-20045 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
BIG-IP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record my.f5.com
Feb 4, 2025Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles.CVE-2025-20898 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.6
Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles.
Product
Samsung Members
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Feb 4, 2025Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.CVE-2025-20894 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.6
Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.
Product
Samsung Email
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Feb 4, 2025Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.CVE-2025-20884 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.6
Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Feb 4, 2025Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.CVE-2025-20883 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.6
Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Jan 31, 2025Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Stored Cross-Site ScriptingCVE-2024-12037 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bf_new_submission_link' shortcode in all versions up to, and including, 2.8.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Affected
up to 2.8.13
What to do
Affects up to 2.8.13. Update Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 25, 2025Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized accessCVE-2024-13370 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the save_addon_key_license() function in all versions up to, and including, 1.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options to a value of a valid license key.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized accessCVE-2024-13368 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the youzify_offer_banner() function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary site options to a value of one.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 25, 2025Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized loss of dataCVE-2024-12113 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_user_review() and delete_review() functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's reviews.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 23, 2025Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.CVE-2024-57386 · Other software · Wallosapp · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.
Product
Wallos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 18, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Information ExposureCVE-2025-0318 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.9.1 through different error messages in the responses. This makes it possible for unauthenticated attackers to exfiltrate data from wp_usermeta table.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Time-based SQL InjectionCVE-2025-0308 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2025In multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing permission check.CVE-2018-9382 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com
Jan 16, 2025Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload fuCVE-2024-40514 · Other software · Themesbrand · reported by MITREMedium 4.6
Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions.
Product
Chatvia
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 16, 2025An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function.CVE-2024-40513 · Other software · Themesbrand · reported by MITREMedium 4.6
An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function.
Product
Chatvia
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 15, 2025WP User Profile Avatar: Cross-Site Request ForgeryCVE-2024-10789 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupa_user_admin() function. This makes it possible for unauthenticated attackers to update the plugins setting which controls access to the functionality via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP User Profile Avatar
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality MisuseCVE-2025-23074 · Other software · Wikimedia Foundation · reported by c4f26cc8-17ff-4c99-b5e2-38fc1793eaccLow 2.4
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misuse.This issue affects Mediawiki - SocialProfile Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
Product
Mediawiki - SocialProfile Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gerrit.wikimedia.org phabricator.wikimedia.org
Jan 13, 2025Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.CVE-2024-12211 · Other software · Pegasystems · reported by security@pega.comMedium 5.4
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.
Product
Pega Infinity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pega.com
Jan 9, 2025BP Profile Shortcodes Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22817 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra bp-profile-shortcodes-extra allows Stored XSS.This issue affects BP Profile Shortcodes Extra: from n/a through <= 2.6.0.
Product
BP Profile Shortcodes Extra
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update BP Profile Shortcodes Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2024-12738 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.12.9
What to do
Affects up to 3.12.9. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2025The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issueCVE-2024-55074 · Other software · Grocy project · reported by MITREHigh 8.8
The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.
Product
Grocy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record m10x.de m10x.de
Jan 6, 2025OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorizeCVE-2024-8474 · Other software · OpenVPN · reported by security@openvpn.netHigh 7.5
OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic
Product
OpenVPN Connect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openvpn.net
Jan 6, 2025Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.CVE-2024-45558 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.qualcomm.com
Dec 16, 2024Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter.CVE-2024-55103 · Websites & servers · Phpgurukul · reported by MITREHigh 7.2
Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter.
Product
Online Nurse Hiring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com phpgurukul.com
Dec 16, 2024A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary wCVE-2024-55100 · Websites & servers · Phpgurukul · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the fullname parameter.
Product
Online Nurse Hiring System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com phpgurukul.com
Dec 16, 20243D Avatar User Profile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Enrico Cantori 3D Avatar User Profile 3d-avatar-user-profile allows Reflected XSS.This issue affects 3D Avatar User Profile: from n/a through <= 1.0.0.
Product
3D Avatar User Profile
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update 3D Avatar User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Post to Google My Business (Google Business Profile): Missing AuthorizationCVE-2023-41689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14.
Product
Post to Google My Business (Google Business Profile)
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update Post to Google My Business (Google Business Profile) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Membership Plan settingsCVE-2024-10518 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.15.15
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.15 or newer.
Full record and what to do →NVD record wpscan.com
Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Drag & Drop Builder fieldsCVE-2024-10517 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.15.15
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.15 or newer.
Full record and what to do →NVD record wpscan.com
Dec 9, 2024ProfilePress: Missing AuthorizationCVE-2023-41953 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress.This issue affects ProfilePress: from n/a through 4.13.1.
Product
ProfilePress
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024ProfilePress: Missing AuthorizationCVE-2023-50882 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through <= 4.13.2.
Product
ProfilePress
Affected
up to 4.13.2
What to do
Affects up to 4.13.2. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Display custom fields in the frontend – Post and User Profile Fields: Missing AuthorizationCVE-2023-31073 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0.
Product
Display custom fields in the frontend – Post and User Profile Fields
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Display custom fields in the frontend – Post and User Profile Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.