Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

456new WordPress flaws this week

393,009entries in the database

11,315 results · page 142 of 227

Dec 18, 2024Partners: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2024-56059 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through <= 0.2.0.
Product
Partners
Affected
up to 0.2.0
What to do
Affects up to 0.2.0. Update Partners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Image Mapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56016 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maartenhemmes Image Mapper image-mapper allows Reflected XSS.This issue affects Image Mapper: from n/a through <= 0.2.5.3.
Product
Image Mapper
Affected
up to 0.2.5.3
What to do
Affects up to 0.2.5.3. Update Image Mapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Device Detector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56010 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Device Detector device-detector allows Reflected XSS.This issue affects Device Detector: from n/a through <= 4.2.0.
Product
Device Detector
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update Device Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024YDS Support Ticket System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55985 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ydesignservices YDS Support Ticket System yds-support-ticket-system allows SQL Injection.This issue affects YDS Support Ticket System: from n/a through <= 1.0.
Product
YDS Support Ticket System
Affected
up to 1.0
What to do
Affects up to 1.0. Update YDS Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Saksh Escrow System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55984 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susheelhbti Saksh Escrow System saksh-escrow-system allows SQL Injection.This issue affects Saksh Escrow System: from n/a through <= 2.4.
Product
Saksh Escrow System
Affected
up to 2.4
What to do
Affects up to 2.4. Update Saksh Escrow System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024PowerFormBuilder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55983 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PowerFormBuilder PowerFormBuilder power-forms-builder allows SQL Injection.This issue affects PowerFormBuilder: from n/a through <= 1.0.6.
Product
PowerFormBuilder
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update PowerFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Dr Affiliate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55975 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rohit Urane Dr Affiliate dr-affiliate allows SQL Injection.This issue affects Dr Affiliate: from n/a through <= 1.2.3.
Product
Dr Affiliate
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Dr Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024hmd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54350 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hjyl hmd hmd allows Stored XSS.This issue affects hmd: from n/a through <= 2.0.
Product
hmd
Affected
up to 2.0
What to do
Affects up to 2.0. Update hmd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Axeptio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-54270 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axeptio Axeptio axeptio-sdk-integration allows PHP Local File Inclusion.This issue affects Axeptio: from n/a through <= 2.5.4.
Product
Axeptio
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Axeptio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Saoshyant Element: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51646 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saoshyant1994 Saoshyant Element saoshyant-element allows Reflected XSS.This issue affects Saoshyant Element: from n/a through <= 1.2.
Product
Saoshyant Element
Affected
up to 1.2
What to do
Affects up to 1.2. Update Saoshyant Element to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Bootstrap Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49677 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Bootstrap Buttons bootstrap-buttons allows Reflected XSS.This issue affects Bootstrap Buttons: from n/a through <= 1.2.
Product
Bootstrap Buttons
Affected
up to 1.2
What to do
Affects up to 1.2. Update Bootstrap Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2024Affiliate Program Suite — SliceWP Affiliates: Cross-Site Request ForgeryCVE-2024-12454 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Affiliate Program Suite — SliceWP Affiliates
Affected
up to 1.1.23
What to do
Affects up to 1.1.23. Update Affiliate Program Suite — SliceWP Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 17, 2024Easy Digital Downloads: Improper AuthorizationCVE-2024-9654 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verify_guest_email' function to ensure the requesting user is the intended recipient of the purchase receipt. This makes it possible for unauthenticated attackers to bypass intended security restrictions and view the receipts of other users, which contains a link to download paid content. Successful exploitation requires knowledge of another customers email address as well as the file ID of the content they purchased.
Product
Easy Digital Downloads
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024PPWP – Password Protect Pages: Sensitive Information ExposureCVE-2024-11280 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Product
PPWP – Password Protect Pages
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update PPWP – Password Protect Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 17, 2024WP All Import Pro: Server-Side Request ForgeryCVE-2024-9624 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance metadata.
Product
WP All Import Pro
Affected
up to 4.9.3
What to do
Affects up to 4.9.3. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Dec 16, 2024Portfolio – Filterable Masonry Portfolio Gallery for Professionals: Stored Cross-Site ScriptingCVE-2024-11900 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'portfolio-pro' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Portfolio – Filterable Masonry Portfolio Gallery for Professionals
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Portfolio – Filterable Masonry Portfolio Gallery for Professionals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2024EazyDocs: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-54376 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Spider Themes EazyDocs eazydocs allows PHP Local File Inclusion.This issue affects EazyDocs: from n/a through <= 2.8.0.
Product
EazyDocs
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Brand: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yaycommerce Brand brand allows Stored XSS.This issue affects Brand: from n/a through <= 1.1.6.
Product
Brand
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Brand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024SeedProd Pro: Unrestricted Upload of File with Dangerous TypeCVE-2024-54285 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedProd Pro: from n/a through 6.18.10.
Product
SeedProd Pro
Affected
up to 6.18.10
What to do
Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024SeedProd Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54284 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10.
Product
SeedProd Pro
Affected
up to 6.18.10
What to do
Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024SeedProd Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54283 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10.
Product
SeedProd Pro
Affected
up to 6.18.10
What to do
Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024WPBookit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54280 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.
Product
WPBookit
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024tydskrif: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54257 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molefed allows Reflected XSS.This issue affects tydskrif: from n/a through 1.1.3.
Product
tydskrif
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update tydskrif to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Advanced Options Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54249 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Advanced Options Editor allows Reflected XSS.This issue affects Advanced Options Editor: from n/a through 1.0.
Product
Advanced Options Editor
Affected
up to 1.0
What to do
Affects up to 1.0. Update Advanced Options Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Responsive Google Maps | by imbaa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56011 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ilja Zaglov Responsive Google Maps | by imbaa responsive-google-maps allows Stored XSS.This issue affects Responsive Google Maps | by imbaa: from n/a through <= 1.2.5.
Product
Responsive Google Maps | by imbaa
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Responsive Google Maps | by imbaa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Dreamfox Media Payment gateway per Product for Woocommerce: Missing AuthorizationCVE-2024-55996 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Missing Authorization vulnerability in dreamfox Dreamfox Media Payment gateway per Product for Woocommerce woocommerce-product-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dreamfox Media Payment gateway per Product for Woocommerce: from n/a through <= 3.5.6.
Product
Dreamfox Media Payment gateway per Product for Woocommerce
Affected
up to 3.5.6
What to do
Affects up to 3.5.6. Update Dreamfox Media Payment gateway per Product for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Mollie for Contact Form 7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55990 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tsjippy Mollie for Contact Form 7 cf7-mollie allows Blind SQL Injection.This issue affects Mollie for Contact Form 7: from n/a through <= 5.0.0.
Product
Mollie for Contact Form 7
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update Mollie for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024WP Simple Pay Lite Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55989 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kyle M Brown WP Simple Pay Lite Manager stripe-manager allows SQL Injection.This issue affects WP Simple Pay Lite Manager: from n/a through <= 1.4.
Product
WP Simple Pay Lite Manager
Affected
up to 1.4
What to do
Affects up to 1.4. Update WP Simple Pay Lite Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Navayan CSV Export: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55988 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export navayan-csv-export allows Blind SQL Injection.This issue affects Navayan CSV Export: from n/a through <= 1.0.9.
Product
Navayan CSV Export
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Navayan CSV Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Advanced What should we write next about: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55987 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ritesh Sanap Advanced What should we write next about advanced-what-should-we-write-about-next allows SQL Injection.This issue affects Advanced What should we write next about: from n/a through <= 1.0.3.
Product
Advanced What should we write next about
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Advanced What should we write next about to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Service: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55986 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tiny13 Service service allows Blind SQL Injection.This issue affects Service: from n/a through <= 1.0.4.
Product
Service
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Share Buttons – Social Media: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55982 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.
Product
Share Buttons – Social Media
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Share Buttons – Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Nabz Image Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55981 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.
Product
Nabz Image Gallery
Affected
up to 1.00
What to do
Affects up to 1.00. Update Nabz Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55980 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.
Product
Wr Age Verification
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55979 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.
Product
Wr Age Verification
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Code Generator Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55978 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WalletStation Code Generator Pro code-generator-pro allows SQL Injection.This issue affects Code Generator Pro: from n/a through <= 1.2.
Product
Code Generator Pro
Affected
up to 1.2
What to do
Affects up to 1.2. Update Code Generator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024LaunchPage.app Importer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55977 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BinaryCarpenter LaunchPage.app Importer launchpage-app-importer allows SQL Injection.This issue affects LaunchPage.app Importer: from n/a through <= 1.1.
Product
LaunchPage.app Importer
Affected
up to 1.1
What to do
Affects up to 1.1. Update LaunchPage.app Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Critical Site Intel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55976 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mikeleembruggen Critical Site Intel critical-site-intel-stats allows SQL Injection.This issue affects Critical Site Intel: from n/a through <= 1.0.
Product
Critical Site Intel
Affected
up to 1.0
What to do
Affects up to 1.0. Update Critical Site Intel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Mimoos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55974 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martí Batlles Martinez Mimoos devoluciones-packback allows SQL Injection.This issue affects Mimoos: from n/a through <= 1.2.
Product
Mimoos
Affected
up to 1.2
What to do
Affects up to 1.2. Update Mimoos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024TSB Occasion Editor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55973 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rnystrom TSB Occasion Editor tsb-occasion-editor allows SQL Injection.This issue affects TSB Occasion Editor: from n/a through <= 1.2.1.
Product
TSB Occasion Editor
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update TSB Occasion Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024eTemplates: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55972 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.
Product
eTemplates
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update eTemplates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Advanced Data Table For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54443 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Advanced Data Table For Elementor advanced-data-table-for-elementor allows Stored XSS.This issue affects Advanced Data Table For Elementor: from n/a through <= 1.0.0.
Product
Advanced Data Table For Elementor
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Advanced Data Table For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Better WP Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54442 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cortesfrau Better WP Login Page better-wp-login-page allows Stored XSS.This issue affects Better WP Login Page: from n/a through <= 1.1.2.
Product
Better WP Login Page
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Better WP Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Utech World Time: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54441 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meini Utech World Time utech-world-time-for-wp allows Stored XSS.This issue affects Utech World Time: from n/a through <= 1.0.
Product
Utech World Time
Affected
up to 1.0
What to do
Affects up to 1.0. Update Utech World Time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Amazon Product Price: Cross-Site Request Forgery (CSRF)CVE-2024-54439 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alok Tiwari Amazon Product Price amazon-product-price allows Stored XSS.This issue affects Amazon Product Price: from n/a through <= 1.1.
Product
Amazon Product Price
Affected
up to 1.1
What to do
Affects up to 1.1. Update Amazon Product Price to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024jCarousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in koolkatwebdesigns jCarousel jcarousel-for-wordpress allows Stored XSS.This issue affects jCarousel: from n/a through <= 1.0.
Product
jCarousel
Affected
up to 1.0
What to do
Affects up to 1.0. Update jCarousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Like in Vk.com: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54424 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilya_compman Like in Vk.com like-on-vkontakte allows Stored XSS.This issue affects Like in Vk.com: from n/a through <= 0.5.2.
Product
Like in Vk.com
Affected
up to 0.5.2
What to do
Affects up to 0.5.2. Update Like in Vk.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Evernote Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54422 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tgw365 Evernote Sync evernote-sync allows Reflected XSS.This issue affects Evernote Sync: from n/a through <= 3.0.0.
Product
Evernote Sync
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Evernote Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024PixProof: Missing AuthorizationCVE-2024-54417 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in pixelgrade PixProof pixproof allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PixProof: from n/a through <= 2.0.1.
Product
PixProof
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update PixProof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024ECT Product Carousel: Cross-Site Request Forgery (CSRF)CVE-2024-54412 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Product Carousel ect-product-carousel allows Stored XSS.This issue affects ECT Product Carousel: from n/a through <= 1.9.
Product
ECT Product Carousel
Affected
up to 1.9
What to do
Affects up to 1.9. Update ECT Product Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.