Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,205 results · page 15 of 25

Nov 15, 2024WP AdCenter – Ad Manager & Adsense Ads: Stored Cross-Site ScriptingCVE-2024-10113 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpadcenter_ad shortcode in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP AdCenter – Ad Manager & Adsense Ads
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update WP AdCenter – Ad Manager & Adsense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 14, 2024WP Course Manager: Cross-Site Request Forgery (CSRF)CVE-2024-51658 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through <= 1.3.
Product
WP Course Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Course Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024Datasets Manager by Arttia Creative: Unrestricted Upload of File with Dangerous TypeCVE-2024-52375 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative datasets-manager-by-arttia-creative.This issue affects Datasets Manager by Arttia Creative: from n/a through <= 1.5.
Product
Datasets Manager by Arttia Creative
Affected
up to 1.5
What to do
Affects up to 1.5. Update Datasets Manager by Arttia Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2024MultiManager WP – Manage All Your WordPress Sites Easily: Authentication BypassCVE-2024-11028 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the user impersonation feature inappropriately determining the current user via user-supplied input. This makes it possible for unauthenticated attackers to generate an impersonation link that will allow them to log in as any existing user, such as an administrator. NOTE: The user impersonation feature was disabled in version 1.1.0 and re-enabled with a patch in version 1.1.2.
Product
MultiManager WP – Manage All Your WordPress Sites Easily
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update MultiManager WP – Manage All Your WordPress Sites Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Insecure Direct Object ReferenceCVE-2024-10174 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'Abstract_Permission' class due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to spoof their identity to that of an administrator and access all of the plugins REST routes.
Product
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Affected
up to 2.6.13
What to do
Affects up to 2.6.13. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 11, 2024Horsemanager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51843 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fruitcakestudios Horsemanager fruitcake-horsemanager allows Blind SQL Injection.This issue affects Horsemanager: from n/a through <= 1.3.
Product
Horsemanager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Horsemanager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Simple Business Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51599 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in russell.albin Simple Business Manager simple-business-manager allows Stored XSS.This issue affects Simple Business Manager: from n/a through <= 4.6.7.4.
Product
Simple Business Manager
Affected
up to 4.6.7.4
What to do
Affects up to 4.6.7.4. Update Simple Business Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Narnoo Commerce Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51708 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Narnoo Narnoo Commerce Manager narnoo-commerce-manager allows Reflected XSS.This issue affects Narnoo Commerce Manager: from n/a through <= 1.6.0.
Product
Narnoo Commerce Manager
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Narnoo Commerce Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Simple Job Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51602 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in oleksandr87 Simple Job Manager simple-job-manager allows SQL Injection.This issue affects Simple Job Manager: from n/a through <= 1.1.
Product
Simple Job Manager
Affected
up to 1.1
What to do
Affects up to 1.1. Update Simple Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Advanced Cron Manager – debug & control: Missing AuthorizationCVE-2024-43154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9.
Product
Advanced Cron Manager – debug & control
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update Advanced Cron Manager – debug & control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WP Job Manager - Resume Manager: Missing AuthorizationCVE-2024-37443 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Automattic WP Job Manager - Resume Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.
Product
WP Job Manager - Resume Manager
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Job Manager - Resume Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024File Manager: Missing AuthorizationCVE-2024-37254 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mndpsingh287 File Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Manager: from n/a through 7.2.7.
Product
File Manager
Affected
up to 7.2.7
What to do
Affects up to 7.2.7. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024User Rights Access Manager: Access ControlCVE-2024-37209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Access Control vulnerability in Prism IT Systems User Rights Access Manager allows . This issue affects User Rights Access Manager: from n/a through 1.1.2.
Product
User Rights Access Manager
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update User Rights Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 31, 2024EKC Tournament Manager: Cross-Site Request Forgery (CSRF)CVE-2024-49674 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issue affects EKC Tournament Manager: from n/a through <= 2.2.1.
Product
EKC Tournament Manager
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update EKC Tournament Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 30, 2024Download Manager: Doesn't sanitize some of it's shortcode parametersCVE-2024-8444 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.
Product
Download Manager
Fixed in
3.3.00
What to do
Update Download Manager to 3.3.00 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2024BP Member Type Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49634 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimon Habib BP Member Type Manager bp-member-type-manager allows Reflected XSS.This issue affects BP Member Type Manager: from n/a through <= 1.01.
Product
BP Member Type Manager
Affected
up to 1.01
What to do
Affects up to 1.01. Update BP Member Type Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Ads.txt & App-ads.txt Manager for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50415 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Ads.txt & App-ads.txt Manager for WordPress app-ads-txt allows Stored XSS.This issue affects Ads.txt & App-ads.txt Manager for WordPress: from n/a through <= 1.1.7.1.
Product
Ads.txt & App-ads.txt Manager for
Affected
up to 1.1.7.1
What to do
Affects up to 1.1.7.1. Update Ads.txt & App-ads.txt Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2024Transients Manager: Cross-Site Request ForgeryCVE-2024-10045 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the process_actions function. This makes it possible for unauthenticated attackers to delete transients via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Transients Manager
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Transients Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2024EU/UK VAT Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44061 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EU/UK VAT Manager for WooCommerce eu-vat-for-woocommerce.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through <= 2.12.14.
Product
EU/UK VAT Manager for WooCommerce
Affected
up to 2.12.14
What to do
Affects up to 2.12.14. Update EU/UK VAT Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024MAS Companies For WP Job Manager: Reflected Cross-Site ScriptingCVE-2024-9206 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MAS Companies For WP Job Manager
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update MAS Companies For WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2024Easy Menu Manager | WPZest: Stored Cross-Site ScriptingCVE-2024-9366 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Easy Menu Manager | WPZest
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Easy Menu Manager | WPZest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 17, 2024Job Board Manager for: Incorrect Privilege AssignmentCVE-2024-49322 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress jemployee allows Privilege Escalation.This issue affects Job Board Manager for WordPress: from n/a through <= 1.0.
Product
Job Board Manager for
Affected
up to 1.0
What to do
Affects up to 1.0. Update Job Board Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024FREE DOWNLOAD MANAGER: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49315 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through <= 1.0.0.
Product
FREE DOWNLOAD MANAGER
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update FREE DOWNLOAD MANAGER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Fonto – Custom Web Fonts Manager: Stored Cross-Site ScriptingCVE-2024-8920 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fonto – Custom Web Fonts Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Fonto – Custom Web Fonts Manager
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Fonto – Custom Web Fonts Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024Disc Golf Manager: Deserialization of Untrusted DataCVE-2024-48026 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through <= 1.0.0.
Product
Disc Golf Manager
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Disc Golf Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to mCVE-2016-15042 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wpscan.com
Oct 16, 2024File Manager Pro: Limited JavaScript File UploadCVE-2024-8918 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024File Manager Pro: Arbitrary backup file downloads and uploadsCVE-2024-8746 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024File Manager Pro: Cross-Site Request ForgeryCVE-2024-8507 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024Advanced Access Manager: Unauthenticated Arbitrary File ReadCVE-2019-25213 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php
Product
Advanced Access Manager
Affected
up to 5.9.8.1
What to do
Affects up to 5.9.8.1. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024File Manager: Authorization bypassCVE-2018-25105 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files that can be used for remote code execution.
Product
File Manager
Affected
up to 3.0
What to do
Affects up to 3.0. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance: Stored Cross-Site ScriptingCVE-2016-15041 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record klikki.fi web.archive.org
Oct 15, 2024SEO Manager: Stored Cross-Site ScriptingCVE-2024-9521 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SEO Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SEO Manager
Affected
up to 1.9
What to do
Affects up to 1.9. Update SEO Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2024WPIDE – File Manager & Code Editor: Full Path DisclosureCVE-2024-9546 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
WPIDE – File Manager & Code Editor
Affected
up to 3.4.9
What to do
Affects up to 3.4.9. Update WPIDE – File Manager & Code Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2024GDPR-Extensions-com – Consent Manager: Stored Cross-Site ScriptingCVE-2024-9072 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GDPR-Extensions-com – Consent Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
GDPR-Extensions-com – Consent Manager
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update GDPR-Extensions-com – Consent Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 6, 2024Multipurpose Ticket Booking Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44037 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam Multipurpose Ticket Booking Manager bus-booking-manager allows Stored XSS.This issue affects Multipurpose Ticket Booking Manager: from n/a through <= 4.2.2.
Product
Multipurpose Ticket Booking Manager
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update Multipurpose Ticket Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024WP-DownloadManager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47341 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lester Chan WP-DownloadManager wp-downloadmanager allows Reflected XSS.This issue affects WP-DownloadManager: from n/a through <= 1.68.8.
Product
WP-DownloadManager
Affected
up to 1.68.8
What to do
Affects up to 1.68.8. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Vmax Project Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44014 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vmax Studio Vmax Project Manager vmax-project-manager allows PHP Local File Inclusion.This issue affects Vmax Project Manager: from n/a through <= 1.0.
Product
Vmax Project Manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update Vmax Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Bit File Manager – 100% Free & Open Source File Manager and Code Editor for: Limited JavaScript File UploadCVE-2024-8743 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
Product
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for
Affected
up to 6.5.7
What to do
Affects up to 6.5.7. Update Bit File Manager – 100% Free & Open Source File Manager and Code Editor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 4, 2024Checkout Field Editor (Checkout Manager) for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-8499 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Checkout Field Editor (Checkout Manager) for WooCommerce
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Checkout Field Editor (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 27, 2024EU/UK VAT Manager for WooCommerce: Unauthorized modification of dataCVE-2024-9189 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT status for any order.
Product
EU/UK VAT Manager for WooCommerce
Affected
up to 2.12.12
What to do
Affects up to 2.12.12. Update EU/UK VAT Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 27, 2024EU/UK VAT Manager for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-8788 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.11. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
EU/UK VAT Manager for WooCommerce
Affected
up to 2.12.11
What to do
Affects up to 2.12.11. Update EU/UK VAT Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 27, 2024Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2024-7149 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.8
What to do
Affects up to 4.0.8. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024Advanced File Manager: Local JavaScript File InclusionCVE-2024-8704 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 via the 'fma_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Advanced File Manager
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024Advanced File Manager: Arbitrary file uploadsCVE-2024-8126 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Advanced File Manager
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2024WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible: Insecure Direct Object ReferenceCVE-2024-8290 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFM_Customers_Manage_Controller::processing function due to missing validation on the ID user controlled key. This makes it possible for authenticated attackers, with subscriber/customer-level access and above, to change the email address of administrator user accounts which allows them to reset the password and access the administrator account.
Product
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Affected
up to 6.7.12
What to do
Affects up to 6.7.12. Update WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2024Pixel Cat – Conversion Pixel Manager: Reflected Cross-Site ScriptingCVE-2024-8544 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pixel Cat – Conversion Pixel Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Pixel Cat – Conversion Pixel Manager
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Pixel Cat – Conversion Pixel Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2024Logo Manager For Enamad: Does not sanitise and escape in its widgets settingsCVE-2024-5170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Logo Manager For Enamad WordPress plugin through 0.7.1 does not sanitise and escape in its widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Logo Manager For Enamad
Affected
up to 0.7.1
What to do
Affects up to 0.7.1. Update Logo Manager For Enamad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024Music Request Manager: Does not sanitise and escape incoming music requestsCVE-2024-6019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators
Product
Music Request Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024Music Request Manager: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6018 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
Music Request Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.