Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

1,095 results · page 17 of 22

Apr 10, 2024custom fields for labels: Ninja Forms prior to 3.8.1 contains a cross-site scriptingCVE-2024-29220 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
Product
custom fields for labels
Fixed in
3.8.1
What to do
Update custom fields for labels to 3.8.1 or newer.
Full record and what to do →NVD record jvn.jp ninjaforms.com
Apr 10, 2024submit processing: Ninja Forms prior to 3.8.1 contains a cross-site scriptingCVE-2024-26019 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
Product
submit processing
Fixed in
3.8.1
What to do
Update submit processing to 3.8.1 or newer.
Full record and what to do →NVD record jvn.jp ninjaforms.com
Apr 10, 2024Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31.CVE-2024-25572 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.
Fixed in
3.4.31
What to do
Update the plugin to 3.4.31 or newer.
Full record and what to do →NVD record jvn.jp ninjaforms.com
Apr 9, 2024RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Privilege escalationCVE-2024-1991 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.3.0.0
What to do
Affects up to 5.3.0.0. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Blind SQL InjectionCVE-2024-1990 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.3.1.0
What to do
Affects up to 5.3.1.0. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Everest Forms: Server-Side Request ForgeryCVE-2024-1812 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Everest Forms
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 7, 2024Formsite | Embed online forms to collect orders, registrations, leads, and surveys: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formsite Formsite | Embed online forms to collect orders, registrations, leads, and surveys allows Stored XSS.This issue affects Formsite | Embed online forms to collect orders, registrations, leads, and surveys: from n/a through 1.6.
Product
Formsite | Embed online forms to collect orders, registrations, leads, and surveys
Affected
up to 1.6
What to do
Affects up to 1.6. Update Formsite | Embed online forms to collect orders, registrations, leads, and surveys to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Contact Forms by Cimatti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30549 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cimatti Contact Forms by Cimatti contact-forms.This issue affects Contact Forms by Cimatti: from n/a through <= 1.8.0.
Product
Contact Forms by Cimatti
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024WP Cost Estimation & Payment Forms Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30489 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75.
Product
WP Cost Estimation & Payment Forms Builder
Affected
up to 10.1.75
What to do
Affects up to 10.1.75. Update WP Cost Estimation & Payment Forms Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024CRM Perks Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30446 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms allows Stored XSS.This issue affects CRM Perks Forms: from n/a through 1.1.4.
Product
CRM Perks Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024CRM Perks Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30499 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
Product
CRM Perks Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024CRM Perks Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30498 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
Product
CRM Perks Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Cross-Site Request ForgeryCVE-2024-2113 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nf_download_all_subs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ninja Forms Contact Form – The Drag and Drop Form Builder for
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Ninja Forms Contact Form – The Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Stored Cross-Site ScriptingCVE-2024-2108 · WordPress plugins & themes · reported by WordfenceMedium 4.6
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a form in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms Contact Form – The Drag and Drop Form Builder for
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Ninja Forms Contact Form – The Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024MailChimp Forms by MailMunch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29793 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailChimp Forms by MailMunch allows Stored XSS.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.2.
Product
MailChimp Forms by MailMunch
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024BuddyForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30198 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeKraft BuddyForms allows Reflected XSS.This issue affects BuddyForms: from n/a through 2.8.5.
Product
BuddyForms
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update BuddyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024PDF Builder for WPForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29820 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedNao PDF Builder for WPForms allows Stored XSS.This issue affects PDF Builder for WPForms: from n/a through 1.2.88.
Product
PDF Builder for WPForms
Affected
up to 1.2.88
What to do
Affects up to 1.2.88. Update PDF Builder for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024CformsII: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22149 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliver Seidel, Bastian Germann CformsII allows Stored XSS.This issue affects CformsII: from n/a through 15.0.5.
Product
CformsII
Affected
up to 15.0.5
What to do
Affects up to 15.0.5. Update CformsII to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: SQL InjectionCVE-2024-2387 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms plugin for WordPress is vulnerable to SQL Injection via the ‘integration_id’ parameter in all versions up to, and including, 1.82.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries and subsequently inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms
Affected
up to 1.82.0
What to do
Affects up to 1.82.0. Update Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2024Contact Forms by Cimatti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29117 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Stored XSS.This issue affects Contact Forms by Cimatti: from n/a through 1.7.0.
Product
Contact Forms by Cimatti
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024NEX-Forms – Ultimate Form Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25593 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.5.
Product
NEX-Forms – Ultimate Form Builder
Affected
up to 8.5.5
What to do
Affects up to 8.5.5. Update NEX-Forms – Ultimate Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Database for Contact Form 7, WPforms, Elementor forms: Stored Cross-Site ScriptingCVE-2024-2030 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Paytium: Mollie payment forms & donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25099 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David de Boer Paytium: Mollie payment forms & donations allows Stored XSS.This issue affects Paytium: Mollie payment forms & donations: from n/a through 4.4.2.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Unauthorized modification of dataCVE-2024-1158 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buddyforms_new_page function in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber access or higher, to create pages with arbitrary titles. These pages are published.
Product
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Fluent Forms plugin for WordPress by Fluent Forms: Stored Cross-Site ScriptingCVE-2023-6957 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.9 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by default is admin.
Product
Fluent Forms plugin for WordPress by Fluent Forms
Affected
up to 5.1.9
What to do
Affects up to 5.1.9. Update Fluent Forms plugin for WordPress by Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 12, 2024weForms: Stored Cross-Site ScriptingCVE-2024-0386 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Referer' HTTP header in all versions up to, and including, 1.6.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
weForms
Affected
up to 1.6.21
What to do
Affects up to 1.6.21. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2024Mollie Forms: Unauthorized access of dataCVE-2024-1645 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrations function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to export payment data collected by this plugin.
Product
Mollie Forms
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update Mollie Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2024Mollie Forms: Unauthorized post or page duplicationCVE-2024-1400 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability check on the duplicateForm function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to duplicate arbitrary posts and pages.
Product
Mollie Forms
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update Mollie Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Unauthorized media file deletionCVE-2024-1170 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the handle_deleted_media function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to delete arbitrary media files.
Product
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Unauthorized media uploadCVE-2024-1169 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media upload due to a missing capability check on the buddyforms_upload_handle_dropped_media function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to upload media files.
Product
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Contact Form builder with drag & drop for WordPress – Kali Forms: Unauthorized access and modification of dataCVE-2024-1218 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API due to an inconsistent capability check on several REST endpoints in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with contributor access and higher, to obtain access to or modify forms or entries.
Product
Contact Form builder with drag & drop for WordPress – Kali Forms
Affected
up to 2.3.41
What to do
Affects up to 2.3.41. Update Contact Form builder with drag & drop for WordPress – Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Contact Form builder with drag & drop for WordPress – Kali Forms: Unauthorized plugin deactivationCVE-2024-1217 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the await_plugin_deactivation function in all versions up to, and including, 2.3.41. This makes it possible for authenticated attackers, with subscriber access or higher, to deactivate any active plugins.
Product
Contact Form builder with drag & drop for WordPress – Kali Forms
Affected
up to 2.3.41
What to do
Affects up to 2.3.41. Update Contact Form builder with drag & drop for WordPress – Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: Unauthorized accessCVE-2024-1130 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_read() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as read.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.6
What to do
Affects up to 8.5.6. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: Unauthorized accessCVE-2024-1129 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_starred() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark records as starred.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.6
What to do
Affects up to 8.5.6. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024NEX-Forms – Ultimate Form Builder – Contact forms and much more: Unauthorized accessCVE-2024-0907 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the restore_records() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to restore records.
Product
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Affected
up to 8.5.6
What to do
Affects up to 8.5.6. Update NEX-Forms – Ultimate Form Builder – Contact forms and much more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2024Smart Forms: Does not have authorisation in various AJAX actionsCVE-2023-7203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.
Product
Smart Forms
Fixed in
2.6.87
What to do
Update Smart Forms to 2.6.87 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 8, 2024WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24881 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.5.2.
Product
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 7, 2024Payment Forms for Paystack: Stored Cross-Site ScriptingCVE-2023-5665 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32130 is likely a duplicate of this issue.
Product
Payment Forms for Paystack
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update Payment Forms for Paystack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Advanced Forms for ACF: Unauthorized access of dataCVE-2024-1121 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_json_file() function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings.
Product
Advanced Forms for ACF
Affected
up to 1.9.3.2
What to do
Affects up to 1.9.3.2. Update Advanced Forms for ACF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-0660 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.7.2. This is due to missing or incorrect nonce validation on the update_settings function. This makes it possible for unauthenticated attackers to change form settings and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Affected
up to 6.7.2
What to do
Affects up to 6.7.2. Update Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Cross-Site Request ForgeryCVE-2024-0374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'create_view' function. This makes it possible for unauthenticated attackers to create views via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Cross-Site Request ForgeryCVE-2024-0373 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'save_view' function. This makes it possible for unauthenticated attackers to modify arbitrary post titles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized access of dataCVE-2024-0372 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_form_fields' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to create form views.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized modification of dataCVE-2024-0371 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'create_view' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to create form views.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Views for WPForms – Display & Edit WPForms Entries on your site frontend: Unauthorized modification of dataCVE-2024-0370 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_view' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to modify the titles of arbitrary posts.
Product
Views for WPForms – Display & Edit WPForms Entries on your site frontend
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Views for WPForms – Display & Edit WPForms Entries on your site frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Unauthorized modification of dataCVE-2024-0324 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' function in all versions up to, and including, 3.10.8. This makes it possible for unauthenticated attackers to enable or disable the 2FA functionality present in the Premium version of the plugin for arbitrary user roles.
Product
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Affected
up to 3.10.8
What to do
Affects up to 3.10.8. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 5, 2024PDF Generator For Fluent Forms – The Contact Form: Stored Cross-Site ScriptingCVE-2023-6953 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The PDF Generator For Fluent Forms – The Contact Form Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the header, PDF body and footer content parameters in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by default is admin.
Product
PDF Generator For Fluent Forms – The Contact Form
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update PDF Generator For Fluent Forms – The Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 2, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Second Order SQL InjectionCVE-2024-0685 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to inject SQL in their email address that will append additional into the already existing query when an administrator triggers a personal data export.
Product
Ninja Forms Contact Form – The Drag and Drop Form Builder for
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update Ninja Forms Contact Form – The Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org sec.stealthcopter.com
Feb 1, 2024RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51509 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login allows Reflected XSS.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.1.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.2.4.1
What to do
Affects up to 5.2.4.1. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51695 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! allows Stored XSS.This issue affects Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: from n/a through 2.0.4.1.
Product
Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!
Affected
up to 2.0.4.1
What to do
Affects up to 2.0.4.1. Update Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.