Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

341new WordPress flaws this week

393,150entries in the database

11,318 results · page 160 of 227

Oct 17, 2024Contact Form 7 – PayPal & Stripe Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48021 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through <= 2.3.
Product
Contact Form 7 – PayPal & Stripe Add-on
Affected
up to 2.3
What to do
Affects up to 2.3. Update Contact Form 7 – PayPal & Stripe Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Encyclopedia / Glossary / Wiki: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49320 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dennis Encyclopedia / Glossary / Wiki encyclopedia-lexicon-glossary-wiki-dictionary allows Reflected XSS.This issue affects Encyclopedia / Glossary / Wiki: from n/a through <= 1.7.60.
Product
Encyclopedia / Glossary / Wiki
Affected
up to 1.7.60
What to do
Affects up to 1.7.60. Update Encyclopedia / Glossary / Wiki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024ShortPixel Image Optimizer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-48043 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
Product
ShortPixel Image Optimizer
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Booking.com Banner Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SPBooking.com Booking.com Banner Creator bookingcom-banner-creator.This issue affects Booking.com Banner Creator: from n/a through <= 1.4.6.
Product
Booking.com Banner Creator
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Booking.com Banner Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024disconnected: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-49268 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sunburntkamel disconnected allows Reflected XSS.This issue affects disconnected: from n/a through 1.3.0.
Product
disconnected
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update disconnected to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Unlimited Addon For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49267 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Unlimited Addon For Elementor unlimited-addon-for-elementor allows Stored XSS.This issue affects Unlimited Addon For Elementor: from n/a through <= 2.0.0.
Product
Unlimited Addon For Elementor
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Unlimited Addon For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024WP-Spreadplugin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49266 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thimo Grauerholz WP-Spreadplugin wp-spreadplugin allows Cross-Site Scripting (XSS).This issue affects WP-Spreadplugin: from n/a through <= 4.8.9.
Product
WP-Spreadplugin
Affected
up to 4.8.9
What to do
Affects up to 4.8.9. Update WP-Spreadplugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Nextend Social Login Pro: Authentication bypassCVE-2024-9893 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.1.14. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
Product
Nextend Social Login Pro
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update Nextend Social Login Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record nextendweb.com wordpress.org
Oct 16, 2024Smart Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49270 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.This issue affects Smart Blocks: from n/a through <= 2.0.
Product
Smart Blocks
Affected
up to 2.0
What to do
Affects up to 2.0. Update Smart Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024ajax-extend: Improper Control of Generation of Code ('Code Injection')CVE-2024-49254 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-extend: from n/a through <= 1.0.
Product
ajax-extend
Affected
up to 1.0
What to do
Affects up to 1.0. Update ajax-extend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Maan Addons For Elementor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-49251 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acnoo Maan Addons For Elementor maan-elementor-addons allows Local Code Inclusion.This issue affects Maan Addons For Elementor: from n/a through <= 1.0.1.
Product
Maan Addons For Elementor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Maan Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Ahime Image Printer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49245 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through <= 1.0.0.
Product
Ahime Image Printer
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ahime Image Printer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024SB Random Posts Widget: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-48029 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget sb-random-posts-widget allows PHP Local File Inclusion.This issue affects SB Random Posts Widget: from n/a through <= 1.0.
Product
SB Random Posts Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update SB Random Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Top Bar – PopUps – by WPOptin: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47645 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows PHP Local File Inclusion.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.1.
Product
Top Bar – PopUps – by WPOptin
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Top Bar – PopUps – by WPOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024MaxSlider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47351 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.This issue affects MaxSlider: from n/a through <= 1.2.3.
Product
MaxSlider
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update MaxSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufCVE-2017-20193 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected
up to 2.0.35
What to do
Affects up to 2.0.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hackerone.com threatpost.com
Oct 16, 2024File Manager Pro: Limited JavaScript File UploadCVE-2024-8918 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024File Manager Pro: Arbitrary backup file downloads and uploadsCVE-2024-8746 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024File Manager Pro: Cross-Site Request ForgeryCVE-2024-8507 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
File Manager Pro
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Oct 16, 2024Product Filter by WooBeWoo: Authorization bypassCVE-2021-4444 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization checks on various functions. This makes it possible for unauthenticated attackers to perform unauthorized actions such as creating new filters and injecting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery.
Product
Product Filter by WooBeWoo
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Product Filter by WooBeWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Indeed Membership Pro: Authorization bypassCVE-2020-36833 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions such as modifying settings and viewing sensitive data.
Product
Indeed Membership Pro
Affected
7.3 to 8.6
What to do
Affects 7.3 to 8.6. Update Indeed Membership Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
Oct 16, 2024Ultimate Membership Pro: Authentication BypassCVE-2020-36832 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user ID.
Product
Ultimate Membership Pro
What to do
Update Ultimate Membership Pro to the newest version.
Full record and what to do →NVD record codecanyon.net wpscan.com
Oct 16, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App: Stored Cross-Site ScriptingCVE-2024-9873 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in posts, comments, and profiles when Markdown support is enabled in all versions up to, and including, 6.4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App
Affected
up to 6.4.6.1
What to do
Affects up to 6.4.6.1. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 11, 2024CM Tooltip Glossary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48041 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary enhanced-tooltipglossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through <= 4.3.9.
Product
CM Tooltip Glossary
Affected
up to 4.3.9
What to do
Affects up to 4.3.9. Update CM Tooltip Glossary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2024Tainacan: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-48040 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows SQL Injection.This issue affects Tainacan: from n/a through <= 0.21.8.
Product
Tainacan
Affected
up to 0.21.8
What to do
Affects up to 0.21.8. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2024Backup and Staging by WP Time Capsule: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-48020 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.21
What to do
Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2024Multi Step for Contact Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47331 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through <= 2.7.7.
Product
Multi Step for Contact Form
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update Multi Step for Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2024PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Reflected Cross-Site ScriptingCVE-2024-9436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.14. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
Affected
up to 3.5.14
What to do
Affects up to 3.5.14. Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Advanced Blocks Pro: Stored Cross-Site ScriptingCVE-2024-9074 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Advanced Blocks Pro
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Advanced Blocks Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 9, 2024Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized modification of dataCVE-2024-9067 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'delete_attachment' function in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Products, Order & Customers Export for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9377 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Products, Order & Customers Export for WooCommerce
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update Products, Order & Customers Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Maximum Products per User for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9205 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Maximum Products per User for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Maximum Products per User for WooCommerce
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update Maximum Products per User for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Stored Cross-Site ScriptingCVE-2024-8987 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's youzify_media shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Zoho Flow: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47334 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow zoho-flow allows SQL Injection.This issue affects Zoho Flow: from n/a through <= 2.7.1.
Product
Zoho Flow
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Zoho Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2024Photo Gallery by 10Web: Does not properly sanitise and escape some of its Gallery settingsCVE-2024-5968 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery by 10Web
Fixed in
1.8.28
What to do
Update Photo Gallery by 10Web to 1.8.28 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2024Limit Login Attempts (Spam Protection): IP Address SpoofingCVE-2022-4534 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.
Product
Limit Login Attempts (Spam Protection)
Affected
up to 5.3
What to do
Affects up to 5.3. Update Limit Login Attempts (Spam Protection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 8, 2024In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS on behalf of the ConCVE-2024-9021 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS on behalf of the Contributor+ by embedding malicious script, which entails account takeover backdoor
Product
process of testing the Relevanssi
Fixed in
4.23.1
What to do
Update process of testing the Relevanssi to 4.23.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2024Bit Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47335 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.13.11.
Product
Bit Form
Affected
up to 2.13.11
What to do
Affects up to 2.13.11. Update Bit Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024WP-WebAuthn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Axton WP-WebAuthn wp-webauthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through <= 1.3.1.
Product
WP-WebAuthn
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WP-WebAuthn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024YITH WooCommerce Ajax Search: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47350 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-ajax-search.This issue affects YITH WooCommerce Ajax Search: from n/a through <= 2.8.0.
Product
YITH WooCommerce Ajax Search
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update YITH WooCommerce Ajax Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024WPExperts Square For GiveWP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47338 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal WPExperts Square For GiveWP wpexperts-square-for-give allows SQL Injection.This issue affects WPExperts Square For GiveWP: from n/a through <= 1.3.
Product
WPExperts Square For GiveWP
Affected
up to 1.3
What to do
Affects up to 1.3. Update WPExperts Square For GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024ShiftController Employee Shift Scheduling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44040 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware ShiftController Employee Shift Scheduling shiftcontroller allows Stored XSS.This issue affects ShiftController Employee Shift Scheduling: from n/a through <= 4.9.64.
Product
ShiftController Employee Shift Scheduling
Affected
up to 4.9.64
What to do
Affects up to 4.9.64. Update ShiftController Employee Shift Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024WP Travel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44039 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel wp-travel allows Stored XSS.This issue affects WP Travel: from n/a through <= 9.3.1.
Product
WP Travel
Affected
up to 9.3.1
What to do
Affects up to 9.3.1. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Multipurpose Ticket Booking Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44037 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam Multipurpose Ticket Booking Manager bus-booking-manager allows Stored XSS.This issue affects Multipurpose Ticket Booking Manager: from n/a through <= 4.2.2.
Product
Multipurpose Ticket Booking Manager
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update Multipurpose Ticket Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Kodex Posts likes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44036 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes kodex-posts-likes allows Stored XSS.This issue affects Kodex Posts likes: from n/a through <= 2.5.0.
Product
Kodex Posts likes
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Kodex Posts likes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Gum Elementor Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44035 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.7.
Product
Gum Elementor Addon
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Gum Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Primary Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44033 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.5.7.
Product
Primary Addon for Elementor
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Primary Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Restaurant & Cafe Addon for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44032 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows Stored XSS.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through <= 1.5.5.
Product
Restaurant & Cafe Addon for Elementor
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Restaurant & Cafe Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024viala: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-44029 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in David Garlitz viala allows Reflected XSS.This issue affects viala: from n/a through 1.3.1.
Product
viala
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update viala to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Gum Elementor Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44027 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.6.
Product
Gum Elementor Addon
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Gum Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.