Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,460entries in the database

9,265 results · page 156 of 186

May 3, 2024CodeBard's Patron Button and Widgets for Patreon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33928 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon allows Reflected XSS.This issue affects CodeBard's Patron Button and Widgets for Patreon: from n/a through 2.2.0.
Product
CodeBard's Patron Button and Widgets for Patreon
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update CodeBard's Patron Button and Widgets for Patreon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024Frontend Admin by DynamiApps: Improper missing encryption exception handling on the 'fea_encrypt' functionCVE-2024-3729 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server.
Product
Frontend Admin by DynamiApps
Affected
up to 3.19.4
What to do
Affects up to 3.19.4. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic: Stored Cross-Site ScriptingCVE-2024-3554 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Min and Max Purchase for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33949 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vark Min and Max Purchase for WooCommerce allows Stored XSS.This issue affects Min and Max Purchase for WooCommerce: from n/a through 2.0.0.
Product
Min and Max Purchase for WooCommerce
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Min and Max Purchase for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024TweetScroll Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33948 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixel Industry TweetScroll Widget allows Stored XSS.This issue affects TweetScroll Widget: from n/a through 1.3.7.
Product
TweetScroll Widget
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update TweetScroll Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024Simple Image Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-4433 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr Digital Simple Image Popup allows Stored XSS.This issue affects Simple Image Popup: from n/a through 2.4.0.
Product
Simple Image Popup
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Simple Image Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024School Management Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-33911 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar School Management Pro.This issue affects School Management Pro: from n/a through 10.3.4.
Product
School Management Pro
Affected
up to 10.3.4
What to do
Affects up to 10.3.4. Update School Management Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024WZone: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-33546 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZone: from n/a through 14.0.10.
Product
WZone
Affected
up to 14.0.10
What to do
Affects up to 14.0.10. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024WZone: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-33544 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone allows SQL Injection.This issue affects WZone: from n/a through 14.0.10.
Product
WZone
Affected
up to 14.0.10
What to do
Affects up to 14.0.10. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Piotnet Addons For Elementor Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Stored XSS.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.
Product
Piotnet Addons For Elementor Pro
Affected
up to 7.1.17
What to do
Affects up to 7.1.17. Update Piotnet Addons For Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Piotnet Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33630 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through 2.4.26.
Product
Piotnet Addons For Elementor
Affected
up to 2.4.26
What to do
Affects up to 2.4.26. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024VOD Infomaniak: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This issue affects VOD Infomaniak: from n/a through <= 1.5.6.
Product
VOD Infomaniak
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024XStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33562 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore allows Reflected XSS.This issue affects XStore: from n/a through 9.3.5.
Product
XStore
Affected
up to 9.3.5
What to do
Affects up to 9.3.5. Update XStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024XStore: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-33559 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.
Product
XStore
Affected
up to 9.3.5
What to do
Affects up to 9.3.5. Update XStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33554 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core allows Reflected XSS.This issue affects XStore Core: from n/a through 5.3.5.
Product
XStore Core
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024XStore Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-33551 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore Core allows SQL Injection.This issue affects XStore Core: from n/a through 5.3.5.
Product
XStore Core
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024WZone: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team WZone allows Reflected XSS.This issue affects WZone: from n/a through 14.0.10.
Product
WZone
Affected
up to 14.0.10
What to do
Affects up to 14.0.10. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024ColorNews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33540 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill ColorNews allows Stored XSS.This issue affects ColorNews: from n/a through 1.2.6.
Product
ColorNews
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update ColorNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024WPZOOM Addons for Elementor (Templates, Widgets): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33539 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor (Templates, Widgets) allows Stored XSS.This issue affects WPZOOM Addons for Elementor (Templates, Widgets): from n/a through 1.1.35.
Product
WPZOOM Addons for Elementor (Templates, Widgets)
Affected
up to 1.1.35
What to do
Affects up to 1.1.35. Update WPZOOM Addons for Elementor (Templates, Widgets) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024WP Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33537 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Horse WP Portfolio allows Stored XSS.This issue affects WP Portfolio: from n/a through 2.4.
Product
WP Portfolio
Affected
up to 2.4
What to do
Affects up to 2.4. Update WP Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Opal Widgets For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33649 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpOpal Opal Widgets For Elementor allows Stored XSS.This issue affects Opal Widgets For Elementor: from n/a through 1.6.9.
Product
Opal Widgets For Elementor
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Opal Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Recencio Book Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33648 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemory Grubb Recencio Book Reviews recencio-book-reviews allows DOM-Based XSS.This issue affects Recencio Book Reviews: from n/a through <= 1.66.0.
Product
Recencio Book Reviews
Affected
up to 1.66.0
What to do
Affects up to 1.66.0. Update Recencio Book Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Easy Set Favicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eftakhairul Islam & Sirajus Salayhin Easy Set Favicon allows Reflected XSS.This issue affects Easy Set Favicon: from n/a through 1.1.
Product
Easy Set Favicon
Affected
up to 1.1
What to do
Affects up to 1.1. Update Easy Set Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Advanced Most Recent Posts Mod: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33643 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey Lampert Advanced Most Recent Posts Mod allows Stored XSS.This issue affects Advanced Most Recent Posts Mod: from n/a through 1.6.5.2.
Product
Advanced Most Recent Posts Mod
Affected
up to 1.6.5.2
What to do
Affects up to 1.6.5.2. Update Advanced Most Recent Posts Mod to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Pretty Google Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33640 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LBell Pretty Google Calendar allows Stored XSS.This issue affects Pretty Google Calendar: from n/a through 1.7.2.
Product
Pretty Google Calendar
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Pretty Google Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Piotnet Addons For Elementor Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33633 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Reflected XSS.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.
Product
Piotnet Addons For Elementor Pro
Affected
up to 7.1.17
What to do
Affects up to 7.1.17. Update Piotnet Addons For Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Filterable Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-4234 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayful Islam Filterable Portfolio allows Stored XSS.This issue affects Filterable Portfolio: from n/a through 1.6.4.
Product
Filterable Portfolio
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024CF7 File Download – File Download for CF7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33697 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rimes Gold CF7 File Download – File Download for CF7 allows Stored XSS.This issue affects CF7 File Download – File Download for CF7: from n/a through 2.0.
Product
CF7 File Download – File Download for CF7
Affected
up to 2.0
What to do
Affects up to 2.0. Update CF7 File Download – File Download for CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024WordPress Ad Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33696 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet XPRESS WordPress Ad Widget allows Stored XSS.This issue affects WordPress Ad Widget: from n/a through 2.20.0.
Product
WordPress Ad Widget
Affected
up to 2.20.0
What to do
Affects up to 2.20.0. Update WordPress Ad Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Fan Page Widget by ThemeNcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33695 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode Fan Page Widget by ThemeNcode allows Stored XSS.This issue affects Fan Page Widget by ThemeNcode: from n/a through 2.0.
Product
Fan Page Widget by ThemeNcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update Fan Page Widget by ThemeNcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Meks ThemeForest Smart Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33694 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks ThemeForest Smart Widget allows Stored XSS.This issue affects Meks ThemeForest Smart Widget: from n/a through 1.5.
Product
Meks ThemeForest Smart Widget
Affected
up to 1.5
What to do
Affects up to 1.5. Update Meks ThemeForest Smart Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Meks Smart Social Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33693 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Smart Social Widget allows Stored XSS.This issue affects Meks Smart Social Widget: from n/a through 1.6.4.
Product
Meks Smart Social Widget
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Meks Smart Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Smart Recent Posts Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33692 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Satrya Smart Recent Posts Widget allows Stored XSS.This issue affects Smart Recent Posts Widget: from n/a through 1.0.3.
Product
Smart Recent Posts Widget
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Smart Recent Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024FameTheme Demo Importer: Cross-Site Request Forgery (CSRF)CVE-2024-33679 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in FameThemes FameTheme Demo Importer.This issue affects FameTheme Demo Importer: from n/a through 1.1.5.
Product
FameTheme Demo Importer
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update FameTheme Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Contact Form 7 Extension For Mailchimp: Cross-Site Request Forgery (CSRF)CVE-2024-33677 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.
Product
Contact Form 7 Extension For Mailchimp
Affected
up to 0.5.70
What to do
Affects up to 0.5.70. Update Contact Form 7 Extension For Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Advanced Post List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33642 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EkoJR Advanced Post List allows Stored XSS.This issue affects Advanced Post List: from n/a through 0.5.6.1.
Product
Advanced Post List
Affected
up to 0.5.6.1
What to do
Affects up to 0.5.6.1. Update Advanced Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024PopupAlly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33639 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects PopupAlly: from n/a through 2.1.1.
Product
PopupAlly
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update PopupAlly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2024Annual Archive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33598 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue affects Annual Archive: from n/a through 1.6.0.
Product
Annual Archive
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Annual Archive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Simple Membership: Stored Cross-Site ScriptingCVE-2024-3730 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Membership
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 25, 2024LoginPress Pro: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024UDesign: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-4077 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign allows Reflected XSS.This issue affects UDesign: from n/a through 4.7.3.
Product
UDesign
Affected
up to 4.7.3
What to do
Affects up to 4.7.3. Update UDesign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Blocksy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32961 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through <= 2.0.33.
Product
Blocksy
Affected
up to 2.0.33
What to do
Affects up to 2.0.33. Update Blocksy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Advanced Order Export For WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2024-31266 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in AlgolPlus Advanced Order Export For WooCommerce allows Code Injection.This issue affects Advanced Order Export For WooCommerce: from n/a through 3.4.4.
Product
Advanced Order Export For WooCommerce
Affected
up to 3.4.4
What to do
Affects up to 3.4.4. Update Advanced Order Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Anti-Malware Security and Brute-Force Firewall: Improper Control of Generation of Code ('Code Injection')CVE-2024-22144 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Eli Scheetz Anti-Malware Security and Brute-Force Firewall gotmls allows Code Injection.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through 4.21.96.
Product
Anti-Malware Security and Brute-Force Firewall
Affected
up to 4.21.96
What to do
Affects up to 4.21.96. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Login as User or Customer (User Switching): Improper AuthenticationCVE-2023-51484 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Customer (User Switching): from n/a through 3.8.
Product
Login as User or Customer (User Switching)
Affected
up to 3.8
What to do
Affects up to 3.8. Update Login as User or Customer (User Switching) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Eazy Plugin Manager: Improper AuthenticationCVE-2023-51482 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Authentication vulnerability in EazyPlugins Eazy Plugin Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eazy Plugin Manager: from n/a through 4.1.2.
Product
Eazy Plugin Manager
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Eazy Plugin Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Build App Online: Improper AuthenticationCVE-2023-51478 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19.
Product
Build App Online
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024BuddyBoss: Improper AuthenticationCVE-2023-51477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in BUDDYBOSS DMCC BuddyBoss Theme allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyBoss Theme: from n/a through 2.4.60.
Product
BuddyBoss
Affected
up to 2.4.60
What to do
Affects up to 2.4.60. Update BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Checkout Mestres WP: Improper AuthenticationCVE-2023-51472 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Privilege Escalation.This issue affects Checkout Mestres WP: from n/a through 7.1.9.7.
Product
Checkout Mestres WP
Affected
up to 7.1.9.7
What to do
Affects up to 7.1.9.7. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Checkout Mestres WP: Improper AuthenticationCVE-2023-51471 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Checkout Mestres WP: from n/a through 7.1.9.7.
Product
Checkout Mestres WP
Affected
up to 7.1.9.7
What to do
Affects up to 7.1.9.7. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.