Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

1,262 results · page 15 of 26

Nov 4, 2024Stacks Mobile App Builder: Unrestricted Upload of File with Dangerous TypeCVE-2024-50527 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web Server.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Product
Stacks Mobile App Builder
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Stacks Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2024Multi Purpose Mail Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-50526 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.
Product
Multi Purpose Mail Form
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Multi Purpose Mail Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com github.com
Nov 4, 2024Helloprint: Unrestricted Upload of File with Dangerous TypeCVE-2024-50525 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in helloprint Helloprint helloprint allows Upload a Web Shell to a Web Server.This issue affects Helloprint: from n/a through <= 2.0.4.
Product
Helloprint
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Helloprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2024All Post Contact Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-50523 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through <= 1.8.2.
Product
All Post Contact Form
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update All Post Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WordPress File Upload: Broken Access ControlCVE-2024-39639 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Broken Access Control vulnerability in Nickolas Bossinas WordPress File Upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress File Upload: from n/a through 4.24.7.
Product
WordPress File Upload
Affected
up to 4.24.7
What to do
Affects up to 4.24.7. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 31, 2024AI Power: Complete AI Pack: Arbitrary file uploadsCVE-2024-10392 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' function in all versions up to, and including, 1.8.89. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
AI Power: Complete AI Pack
Affected
up to 1.8.89
What to do
Affects up to 1.8.89. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 30, 2024Easy SVG Upload: Stored Cross-Site ScriptingCVE-2024-9708 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy SVG Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Easy SVG Upload
Affected
up to 1.1
What to do
Affects up to 1.1. Update Easy SVG Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 30, 2024WP donimedia carousel: Unrestricted Upload of File with Dangerous TypeCVE-2024-50511 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through <= 1.0.1.
Product
WP donimedia carousel
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP donimedia carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 30, 2024AR For Woocommerce: Unrestricted Upload of File with Dangerous TypeCVE-2024-50510 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through <= 6.3.
Product
AR For Woocommerce
Affected
up to 6.3
What to do
Affects up to 6.3. Update AR For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024FileOrganizer – Manage WordPress and Website Files: Arbitrary file uploadsCVE-2024-7985 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the "fileorganizer_ajax_handler" function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: The FileOrganizer Pro plugin must be installed and active to allow Subscriber+ users to upload files.
Product
FileOrganizer – Manage WordPress and Website Files
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update FileOrganizer – Manage WordPress and Website Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2024Ajar in5 Embed: Unrestricted Upload of File with Dangerous TypeCVE-2024-50473 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through <= 3.1.3.
Product
Ajar in5 Embed
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Ajar in5 Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024SurveyJS: Unrestricted Upload of File with Dangerous TypeCVE-2024-50427 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in devsoftbaltic SurveyJS surveyjs.This issue affects SurveyJS: from n/a through <= 1.9.136.
Product
SurveyJS
Affected
up to 1.9.136
What to do
Affects up to 1.9.136. Update SurveyJS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024aDirectory: Unrestricted Upload of File with Dangerous TypeCVE-2024-50420 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in aDirectory aDirectory adirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through <= 1.3.
Product
aDirectory
Affected
up to 1.3
What to do
Affects up to 1.3. Update aDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Sudan Payment Gateway for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2024-50494 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce wc-sudan-payment-gateway allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through <= 1.2.2.
Product
Sudan Payment Gateway for WooCommerce
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Sudan Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Automatic Translation: Unrestricted Upload of File with Dangerous TypeCVE-2024-50493 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in masterhomepage Automatic Translation automatic-translation allows Upload a Web Shell to a Web Server.This issue affects Automatic Translation: from n/a through <= 1.0.4.
Product
Automatic Translation
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Automatic Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Multi Purpose Mail Form: Unrestricted Upload of File with Dangerous TypeCVE-2024-50484 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.
Product
Multi Purpose Mail Form
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Multi Purpose Mail Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Woocommerce Product Design: Unrestricted Upload of File with Dangerous TypeCVE-2024-50482 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
Product
Woocommerce Product Design
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Marketing Automation by AZEXO: Unrestricted Upload of File with Dangerous TypeCVE-2024-50480 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Upload a Web Shell to a Web Server.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80.
Product
Marketing Automation by AZEXO
Affected
up to 1.27.80
What to do
Affects up to 1.27.80. Update Marketing Automation by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024AR For: Unrestricted Upload of File with Dangerous TypeCVE-2024-50496 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 6.6.
Product
AR For
Affected
up to 6.6
What to do
Affects up to 6.6. Update AR For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024Plugin Propagator: Unrestricted Upload of File with Dangerous TypeCVE-2024-50495 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in nunomorgadinho Plugin Propagator wp-propagator allows Upload a Web Shell to a Web Server.This issue affects Plugin Propagator: from n/a through <= 0.1.
Product
Plugin Propagator
Affected
up to 0.1
What to do
Affects up to 0.1. Update Plugin Propagator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2024Wux Blog Editor: Arbitrary file uploadsCVE-2024-9932 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Wux Blog Editor
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Wux Blog Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2024File Upload Types by WPForms: Stored Cross-Site ScriptingCVE-2024-10016 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
File Upload Types by WPForms
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update File Upload Types by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 23, 2024Custom Icons for Elementor: Unrestricted Upload of File with Dangerous TypeCVE-2024-49676 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Unrestricted Upload of File with Dangerous Type vulnerability in Michael Bourne Custom Icons for Elementor custom-icons-for-elementor allows Upload a Web Shell to a Web Server.This issue affects Custom Icons for Elementor: from n/a through <= 0.3.3.
Product
Custom Icons for Elementor
Affected
up to 0.3.3
What to do
Affects up to 0.3.3. Update Custom Icons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2024AI Image Generator for Your Content & Featured Images – AI Postpix: Unrestricted Upload of File with Dangerous TypeCVE-2024-49671 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Dogu Pekgoz AI Image Generator for Your Content & Featured Images – AI Postpix ai-postpix allows Upload a Web Shell to a Web Server.This issue affects AI Image Generator for Your Content & Featured Images – AI Postpix: from n/a through <= 1.1.8.
Product
AI Image Generator for Your Content & Featured Images – AI Postpix
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update AI Image Generator for Your Content & Featured Images – AI Postpix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2024INK Official: Unrestricted Upload of File with Dangerous TypeCVE-2024-49669 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Alexander De Ridder INK Official ink-official allows Upload a Web Shell to a Web Server.This issue affects INK Official: from n/a through <= 4.1.2.
Product
INK Official
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update INK Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2024Verbalize WP: Unrestricted Upload of File with Dangerous TypeCVE-2024-49668 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in christopherdewese1099 Verbalize WP verbalize-wp allows Upload a Web Shell to a Web Server.This issue affects Verbalize WP: from n/a through <= 1.0.
Product
Verbalize WP
Affected
up to 1.0
What to do
Affects up to 1.0. Update Verbalize WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2024Woocommerce Custom Profile Picture: Unrestricted Upload of File with Dangerous TypeCVE-2024-49658 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in ecomerciar Woocommerce Custom Profile Picture woo-custom-profile-picture allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Custom Profile Picture: from n/a through <= 1.0.
Product
Woocommerce Custom Profile Picture
Affected
up to 1.0
What to do
Affects up to 1.0. Update Woocommerce Custom Profile Picture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2024Portfolleo: Unrestricted Upload of File with Dangerous TypeCVE-2024-49653 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in james-eggers Portfolleo portfolleo allows Upload a Web Shell to a Web Server.This issue affects Portfolleo: from n/a through <= 1.2.
Product
Portfolleo
Affected
up to 1.2
What to do
Affects up to 1.2. Update Portfolleo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 20243D Work In Progress: Unrestricted Upload of File with Dangerous TypeCVE-2024-49652 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Renata Bracichowicz 3D Work In Progress renee-work-in-progress allows Upload a Web Shell to a Web Server.This issue affects 3D Work In Progress: from n/a through <= 1.0.3.
Product
3D Work In Progress
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update 3D Work In Progress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024photokit: Unrestricted Upload of File with Dangerous TypeCVE-2024-49610 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in photokiteditor photokit photokit allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through <= 1.0.
Product
photokit
Affected
up to 1.0
What to do
Affects up to 1.0. Update photokit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024WP Dropbox Dropins: Unrestricted Upload of File with Dangerous TypeCVE-2024-49607 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in redhopit WP Dropbox Dropins wp-dropbox-dropins allows Upload a Web Shell to a Web Server.This issue affects WP Dropbox Dropins: from n/a through <= 1.0.
Product
WP Dropbox Dropins
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Dropbox Dropins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Property Lot Management System: Unrestricted Upload of File with Dangerous TypeCVE-2024-49331 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System plms allows Upload a Web Shell to a Web Server.This issue affects Property Lot Management System: from n/a through <= 4.2.38.
Product
Property Lot Management System
Affected
up to 4.2.38
What to do
Affects up to 4.2.38. Update Property Lot Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Nice Backgrounds: Unrestricted Upload of File with Dangerous TypeCVE-2024-49330 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds nicebackgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through <= 1.0.
Product
Nice Backgrounds
Affected
up to 1.0
What to do
Affects up to 1.0. Update Nice Backgrounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024WP REST API FNS: Unrestricted Upload of File with Dangerous TypeCVE-2024-49329 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Upload a Web Shell to a Web Server.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
Product
WP REST API FNS
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP REST API FNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Woostagram Connect: Unrestricted Upload of File with Dangerous TypeCVE-2024-49327 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in bepitulaz Woostagram Connect woostagram-connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through <= 1.0.2.
Product
Woostagram Connect
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Woostagram Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Affiliator: Unrestricted Upload of File with Dangerous TypeCVE-2024-49326 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Vasileios Kerasiotis Affiliator affiliator-lite allows Upload a Web Shell to a Web Server.This issue affects Affiliator: from n/a through <= 2.1.3.
Product
Affiliator
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Affiliator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Sovratec Case Management: Unrestricted Upload of File with Dangerous TypeCVE-2024-49324 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in sovratecdev Sovratec Case Management sovratec-case-management allows Upload a Web Shell to a Web Server.This issue affects Sovratec Case Management: from n/a through <= 1.0.0.
Product
Sovratec Case Management
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Sovratec Case Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Product Website Showcase: Unrestricted Upload of File with Dangerous TypeCVE-2024-49611 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in paxmanpwnz Product Website Showcase product-websites-showcase allows Upload a Web Shell to a Web Server.This issue affects Product Website Showcase: from n/a through <= 1.0.
Product
Product Website Showcase
Affected
up to 1.0
What to do
Affects up to 1.0. Update Product Website Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024JiangQie Free Mini Program: Unrestricted Upload of File with Dangerous TypeCVE-2024-49314 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in jiangqie JiangQie Free Mini Program jiangqie-free-mini-program allows Upload a Web Shell to a Web Server.This issue affects JiangQie Free Mini Program: from n/a through <= 2.5.2.
Product
JiangQie Free Mini Program
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update JiangQie Free Mini Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Cooked Pro: Unrestricted Upload of File with Dangerous TypeCVE-2024-49291 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Gora Tech LLC Cooked Pro.This issue affects Cooked Pro: from n/a before 1.8.0.
Product
Cooked Pro
Fixed in
1.8.0
What to do
Update Cooked Pro to 1.8.0 or newer.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024WordPress Gallery Plugin – Limb Image Gallery: Unrestricted Upload of File with Dangerous TypeCVE-2024-49260 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Limbcode WordPress Gallery Plugin – Limb Image Gallery limb-gallery allows Code Injection.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through <= 1.5.7.
Product
WordPress Gallery Plugin – Limb Image Gallery
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update WordPress Gallery Plugin – Limb Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Analyse Uploads: Relative Path TraversalCVE-2024-49253 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through <= 0.5.
Product
Analyse Uploads
Affected
up to 0.5
What to do
Affects up to 0.5. Update Analyse Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Digital Lottery: Unrestricted Upload of File with Dangerous TypeCVE-2024-49242 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery digital-lottery allows Upload a Web Shell to a Web Server.This issue affects Digital Lottery: from n/a through <= 3.0.5.
Product
Digital Lottery
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Digital Lottery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Feed Comments Number: Unrestricted Upload of File with Dangerous TypeCVE-2024-49216 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in jclay06 Feed Comments Number feed-comments-number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through <= 0.2.1.
Product
Feed Comments Number
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Feed Comments Number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024ACF Images Search And Insert: Unrestricted Upload of File with Dangerous TypeCVE-2024-48035 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in takayukii ACF Images Search And Insert acf-images-search-and-insert allows Upload a Web Shell to a Web Server.This issue affects ACF Images Search And Insert: from n/a through <= 1.1.4.
Product
ACF Images Search And Insert
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update ACF Images Search And Insert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Creates 3D Flipbook, PDF Flipbook: Unrestricted Upload of File with Dangerous TypeCVE-2024-48034 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in fliperrr Creates 3D Flipbook, PDF Flipbook create-flipbook-from-pdf allows Upload a Web Shell to a Web Server.This issue affects Creates 3D Flipbook, PDF Flipbook: from n/a through <= 1.2.
Product
Creates 3D Flipbook, PDF Flipbook
Affected
up to 1.2
What to do
Affects up to 1.2. Update Creates 3D Flipbook, PDF Flipbook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024External featured image from bing: Unrestricted Upload of File with Dangerous TypeCVE-2024-48027 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in xaraartech External featured image from bing external-featured-image-from-bing allows Upload a Web Shell to a Web Server.This issue affects External featured image from bing: from n/a through <= 1.0.2.
Product
External featured image from bing
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update External featured image from bing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Iconize: Unrestricted Upload of File with Dangerous TypeCVE-2024-47649 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in THATplugin Iconize iconize.This issue affects Iconize: from n/a through <= 1.2.4.
Product
Iconize
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Iconize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Azz Anonim Posting: Unrestricted Upload of File with Dangerous TypeCVE-2024-49257 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting azz-anonim-posting allows Upload a Web Shell to a Web Server.This issue affects Azz Anonim Posting: from n/a through <= 0.9.
Product
Azz Anonim Posting
Affected
up to 0.9
What to do
Affects up to 0.9. Update Azz Anonim Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Migration, Backup, Staging – WPvivid: Arbitrary file uploadsCVE-2020-36842 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently extracted. This affects versions up to, and including 0.9.35.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.35
What to do
Affects up to 0.9.35. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org webarxsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.