Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,675 results · page 17 of 34
Jul 13, 2024wp-eMember: Does not have CSRF checks in some placesCVE-2024-5076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- wp-eMember
- Fixed in
- 10.6.6
- What to do
- Update wp-eMember to 10.6.6 or newer.
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5075 · WordPress plugins & themes · reported by WPScanMedium 5.9
The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- wp-eMember
- Fixed in
- 10.6.6
- What to do
- Update wp-eMember to 10.6.6 or newer.
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5074 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- wp-eMember
- Fixed in
- 10.6.6
- What to do
- Update wp-eMember to 10.6.6 or newer.
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37113 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
- Product
- WishList Member X
- Fixed in
- 3.26.7
- What to do
- Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37110 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
- Product
- WishList Member X
- Fixed in
- 3.26.7
- What to do
- Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2024idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6CVE-2024-40328 · Other software · idccms_project · reported by MITREMedium 6.3
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6
- Product
- idccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Paid Memberships Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37486 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.
- Product
- Paid Memberships Pro
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 9, 2024WishList Member X: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37112 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
- Product
- WishList Member X
- Fixed in
- 3.26.7
- What to do
- Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 2, 2024Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner.CVE-2024-34596 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner.
- Product
- SmartThings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 29, 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Time-based SQL InjectionCVE-2024-6265 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2024In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers inCVE-2024-5714 · Other software · lunary-ai · reported by security@huntr.devMedium 6.8
In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers in requests, enabling them to invite users to projects in other organizations, change members to projects in other organizations with escalated privileges, and change members from other organizations to their own or other projects, also with escalated privileges. This vulnerability is due to the backend's failure to validate project identifiers against the current user's organization ID and projects belonging to it, as well as a misconfiguration in attribute naming (`org_id` should be `orgId`) that prevents proper user organization validation. As a result, attackers can cause inconsistencies on the platform for affected users and organizations, including unauthorized privilege escalation. The issue is present in the backend API endpoints for user invitation and modification, specifically in the handling of project IDs in requests.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2024An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier (pan ID), leading to a dCVE-2024-3043 · Other software · silabs.com · reported by product-security@silabs.comHigh 7.5
An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier (pan ID), leading to a denial of service. This packet type is not useful in production and should be used only for PHY qualification.
- Product
- Ember ZNet SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.comgithub.com
Jun 24, 2024WishList Member X: Missing AuthorizationCVE-2024-37111 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
- Product
- WishList Member X
- Fixed in
- 3.26.7
- What to do
- Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 24, 2024WishList Member X: Improper Control of Generation of Code ('Code Injection')CVE-2024-37109 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows Code Injection.This issue affects WishList Member X: from n/a before 3.26.7.
- Product
- WishList Member X
- Fixed in
- 3.26.7
- What to do
- Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 24, 2024WishList Member X: Improper Privilege ManagementCVE-2024-37107 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Membership Software WishList Member X allows Privilege Escalation.This issue affects WishList Member X: from n/a before 3.26.7.
- Product
- WishList Member X
- Fixed in
- 3.26.7
- What to do
- Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 22, 2024ARMember Premium: Cross-Site Request ForgeryCVE-2024-5596 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The ARMember Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.7. This is due to incorrectly implemented nonce validation function on multiple functions. This makes it possible for unauthenticated attackers to modify, or delete user meta and plugin options which can lead to limited privilege escalation.
- Product
- ARMember Premium
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update ARMember Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jun 21, 2024In the Linux kernel, the following vulnerability has been resolved: tracing/probes: fix error check in parse_btf_field() btf_find_struct_member() might returnCVE-2024-36481 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: tracing/probes: fix error check in parse_btf_field() btf_find_struct_member() might return NULL or an error via the ERR_PTR() macro. However, its caller in parse_btf_field() only checks for the NULL condition. Fix this by using IS_ERR() and returning the error up the stack.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 20, 2024In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struCVE-2024-38619 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). - Add a member "media_initialized" to struct alauda_info. - Change a condition in alauda_check_media() to ensure the first initialization. - Add an error check for the return value of alauda_init_media().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 19, 2024Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: SQL InjectionCVE-2024-4742 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the order_by shortcode attribute in all versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 19, 2024Paid Memberships Pro: Missing AuthorizationCVE-2023-39990 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.
- Product
- Paid Memberships Pro
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 19, 2024Paid Memberships Pro CCBill Gateway: Missing AuthorizationCVE-2023-40608 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBill Gateway: from n/a through 0.3.
- Product
- Paid Memberships Pro CCBill Gateway
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Paid Memberships Pro CCBill Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 19, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-1407 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to subscribe to, modify, or cancel membership for a user via a forged request granted they can trick a user into performing an action such as clicking on a link.
- Product
- Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
- Affected
- up to 2.12.10
- What to do
- Affects up to 2.12.10. Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2024Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C)CVE-2024-0066 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 5.3
Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (Axis device) and (O3C) server. If O3C is not being used this flaw does not apply. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.CVE-2024-5685 · Other software · snipe · reported by 596c5446-0ce5-4ba2-aa66-48b3b757a647High 7.6
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.checkmarx.netdevhub.checkmarx.com
Jun 6, 2024In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign theCVE-2024-5127 · Other software · lunary-ai · reported by security@huntr.devMedium 5.4
In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign them any role, including those intended for Paid and Enterprise plans only. This issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. The vulnerability specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024BuddyPress Members Only: Sensitive Information ExposureCVE-2024-0972 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BuddyPress Members Only plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.9 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "All Other Sections On Your Site Will be Opened to Guest" feature (when unset) and view restricted page and post content.
- Product
- BuddyPress Members Only
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update BuddyPress Members Only to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 4, 2024ARMember: Improper Privilege ManagementCVE-2023-47837 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.
- Product
- ARMember
- Affected
- up to 4.0.10
- What to do
- Affects up to 4.0.10. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024wp-eMember: Does not sanitize and escape the "fieldId" parameter before outputting it back in the pageCVE-2024-4749 · WordPress plugins & themes · reported by WPScanHigh 8.3
The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- wp-eMember
- Fixed in
- 10.3.9
- What to do
- Update wp-eMember to 10.3.9 or newer.
May 26, 2024Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playboCVE-2024-32045 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.9
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
May 26, 2024Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in aCVE-2024-31859 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
May 22, 2024Ghost before 5.82.0 allows CSV Injection during a member CSV export.CVE-2024-34448 · Other software · ghost · reported by MITREHigh 8.8
Ghost before 5.82.0 allows CSV Injection during a member CSV export.
- Product
- ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2024Memberpress: Blind Server-Side Request ForgeryCVE-2024-5031 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Memberpress
- Affected
- up to 1.11.29
- What to do
- Affects up to 1.11.29. Update Memberpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmemberpress.comwordfence.com
May 22, 2024Memberpress: Stored Cross-Site ScriptingCVE-2024-5025 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Memberpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arglist’ parameter in all versions up to, and including, 1.11.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Memberpress
- Affected
- up to 1.11.29
- What to do
- Affects up to 1.11.29. Update Memberpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmemberpress.comwordfence.com
May 17, 2024s2Member Pro: Improper Privilege ManagementCVE-2024-31237 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Privilege Management vulnerability in WP Sharks s2Member Pro allows Privilege Escalation.This issue affects s2Member Pro: from n/a through 240315.
- Product
- s2Member Pro
- Affected
- up to 240315
- What to do
- Affects up to 240315. Update s2Member Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024ARMember: Improper Privilege ManagementCVE-2023-51356 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.
- Product
- ARMember
- Affected
- up to 4.0.10
- What to do
- Affects up to 4.0.10. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Simple Membership: Improper Privilege ManagementCVE-2023-41957 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Privilege Management vulnerability in smp7, wp.Insider Simple Membership allows Privilege Escalation.This issue affects Simple Membership: from n/a through 4.3.4.
- Product
- Simple Membership
- Affected
- up to 4.3.4
- What to do
- Affects up to 4.3.4. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Simple Membership: Improper AuthenticationCVE-2023-41956 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4.
- Product
- Simple Membership
- Affected
- up to 4.3.4
- What to do
- Affects up to 4.3.4. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members.CVE-2024-4774 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members. This vulnerability affects Firefox < 126.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 14, 2024php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value.CVE-2024-34914 · Websites & servers · php-censor · reported by MITREMedium 5.3
php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value. This allows attackers to bruteforce to bruteforce the remember_key value to gain access to accounts that have checked "remember me" when logging in.
- Product
- php-censor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchmod744.super.sitechmod744.super.site
May 14, 2024Simple Membership: Stored Cross-Site ScriptingCVE-2024-4383 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple Membership
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2024ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: Open RedirectCVE-2024-4133 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.0.30. This is due to insufficient validation on the redirect url supplied via the redirect_to parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
- Affected
- up to 4.0.30
- What to do
- Affects up to 4.0.30. Update ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2024ProfileGrid – User Profiles, Memberships, Groups and Communities: Unauthorized deletion of dataCVE-2024-3606 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pm_upload_cover_image function in all versions up to, and including, 5.8.3. This makes it possible for authenticated attackers, with subscriber access or higher, to delete attachments.
- Product
- ProfileGrid – User Profiles, Memberships, Groups and Communities
- Affected
- up to 5.8.3
- What to do
- Affects up to 5.8.3. Update ProfileGrid – User Profiles, Memberships, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-3215 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the pmpro_update_level_group_order() function. This makes it possible for unauthenticated attackers to update order levels via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-2867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 4.15.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.15.4
- What to do
- Affects up to 4.15.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2024-2765 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Skype and Spotify URL parameters in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024WP-Members Membership: Information ExposureCVE-2024-2920 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.
- Product
- WP-Members Membership
- Affected
- up to 3.4.9.3
- What to do
- Affects up to 3.4.9.3. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 25, 2024Simple Membership: Stored Cross-Site ScriptingCVE-2024-3730 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple Membership
- Affected
- up to 4.4.3
- What to do
- Affects up to 4.4.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 24, 2024Paid Memberships Pro: Cross-Site Request Forgery (CSRF)CVE-2024-32794 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.
- Product
- Paid Memberships Pro
- Affected
- up to 2.12.10
- What to do
- Affects up to 2.12.10. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024Paid Memberships Pro: Cross-Site Request Forgery (CSRF)CVE-2024-32793 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.
- Product
- Paid Memberships Pro
- Affected
- up to 2.12.10
- What to do
- Affects up to 2.12.10. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024Paid Member Subscriptions: Cross-Site Request Forgery (CSRF)CVE-2024-32728 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.11.0.
- Product
- Paid Member Subscriptions
- Affected
- up to 2.11.0
- What to do
- Affects up to 2.11.0. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.