Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,264 results · page 17 of 26

Jul 13, 2024wp-eMember: Does not validate files to be uploadedCVE-2024-5080 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server
Product
wp-eMember
Fixed in
10.6.6
What to do
Update wp-eMember to 10.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Realtyna Organic IDX: Unrestricted Upload of File with Dangerous TypeCVE-2024-38736 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Realtyna Realtyna Organic IDX plugin allows Code Injection.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.13.
Product
Realtyna Organic IDX
Affected
up to 4.14.13
What to do
Affects up to 4.14.13. Update Realtyna Organic IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024Import Spreadsheets from Microsoft Excel: Unrestricted Upload of File with Dangerous TypeCVE-2024-38734 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Code Injection.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through 10.1.4.
Product
Import Spreadsheets from Microsoft Excel
Affected
up to 10.1.4
What to do
Affects up to 10.1.4. Update Import Spreadsheets from Microsoft Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024Quotes and Tips by BestWebSoft: Does not properly validate image files uploadedCVE-2024-3112 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
Quotes and Tips by BestWebSoft
Fixed in
1.45
What to do
Update Quotes and Tips by BestWebSoft to 1.45 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 9, 2024Featured Image Generator: Unauthorized image uploadCVE-2024-5677 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the fig_save_after_generate_image function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary images to a post-related gallery.
Product
Featured Image Generator
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Featured Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Advanced File Manager Shortcodes: Arbitrary file uploadsCVE-2023-7061 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Advanced File Manager Shortcodes
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Advanced File Manager Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advancedfilemanager.com wordfence.com
Jul 9, 2024Newspack Blocks: Unrestricted Upload of File with Dangerous TypeCVE-2024-37424 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspack Blocks: from n/a through 3.0.8.
Product
Newspack Blocks
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Zita Elementor Site Library: Unrestricted Upload of File with Dangerous TypeCVE-2024-37420 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affects Zita Elementor Site Library: from n/a through 1.6.1.
Product
Zita Elementor Site Library
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Zita Elementor Site Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Church Admin: Unrestricted Upload of File with Dangerous TypeCVE-2024-37418 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6.
Product
Church Admin
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024ScrollTo Bottom: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6321 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ScrollTo Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.1.1. This is due to missing nonce validation and missing file type validation in the 'options_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ScrollTo Bottom
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update ScrollTo Bottom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024ScrollTo Top: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6320 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ScrollTo Top plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.2.2. This is due to missing nonce validation and missing file type validation in the 'options_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ScrollTo Top
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update ScrollTo Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6317 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Generate PDF using Contact Form 7
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6316 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-37555 is a duplicate of this issue.
Product
Generate PDF using Contact Form 7
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024IQ Testimonials: Arbitrary file uploadsCVE-2024-6314 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process_image_upload' function in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can only be exploited if the 'gd' php extension is not loaded on the server.
Product
IQ Testimonials
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update IQ Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Gutenberg Forms: Arbitrary file uploadsCVE-2024-6313 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function in versions up to, and including, 2.2.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Gutenberg Forms
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update Gutenberg Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Advanced AJAX Page Loader: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6310 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Advanced AJAX Page Loader
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update Advanced AJAX Page Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Attachment File Icons (AF Icons): Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6309 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.3. This is due to missing nonce validation in the 'afi_overview' function and missing file type validation in the 'upload_icons' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Attachment File Icons (AF Icons)
Affected
up to 1.3
What to do
Affects up to 1.3. Update Attachment File Icons (AF Icons) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Default Thumbnail Plus: Arbitrary file uploadsCVE-2024-6161 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'get_cache_image' function in all versions up to, and including, 1.0.2.3. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Default Thumbnail Plus
Affected
up to 1.0.2.3
What to do
Affects up to 1.0.2.3. Update Default Thumbnail Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Bit Form: Arbitrary file uploadsCVE-2024-6123 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Bit Form
Affected
up to 2.13.3
What to do
Affects up to 2.13.3. Update Bit Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Generate PDF using Contact Form 7: Unrestricted Upload of File with Dangerous TypeCVE-2024-37555 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affects Generate PDF using Contact Form 7: from n/a through <= 4.1.2.
Product
Generate PDF using Contact Form 7
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Generate PDF using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Modern Events Calendar: Arbitrary file uploadsCVE-2024-5441 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability.
Product
Modern Events Calendar
Affected
up to 7.11.0
What to do
Affects up to 7.11.0. Update Modern Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record webnus.net wordfence.com
Jul 4, 2024IMGspider: Arbitrary file uploadsCVE-2024-6319 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
IMGspider
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update IMGspider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2024IMGspider: Arbitrary file uploadsCVE-2024-6318 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
IMGspider
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update IMGspider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2024Interactive Content: Does not validate uploadsCVE-2024-3111 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues
Product
Interactive Content
Fixed in
1.15.8
What to do
Update Interactive Content to 1.15.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 26, 2024Auto Featured Image: Arbitrary file uploadsCVE-2024-6054 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post_attachment_from_url' function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Auto Featured Image
Affected
up to 1.2
What to do
Affects up to 1.2. Update Auto Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 26, 2024WebP & SVG Support: Does not sanitise uploaded SVG filesCVE-2024-3633 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
WebP & SVG Support
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update WebP & SVG Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 25, 2024Mime Types Extended: Does not sanitise uploaded SVG filesCVE-2024-4759 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
Mime Types Extended
Affected
up to 0.11
What to do
Affects up to 0.11. Update Mime Types Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 24, 2024InstaWP Connect: Unrestricted Upload of File with Dangerous TypeCVE-2024-37228 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.38.
Product
InstaWP Connect
Affected
up to 0.1.0.38
What to do
Affects up to 0.1.0.38. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Squeeze: Unrestricted Upload of File with Dangerous TypeCVE-2024-35767 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Code Injection.This issue affects Squeeze: from n/a through 1.4.
Product
Squeeze
Affected
up to 1.4
What to do
Affects up to 1.4. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024Pexels: Free Stock Photos: Arbitrary file uploadsCVE-2024-6132 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pexels: Free Stock Photos plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'pexels_fsp_images_options_validate' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Pexels: Free Stock Photos
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Pexels: Free Stock Photos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Image Optimizer, Resizer and CDN – Sirv: Arbitrary file uploadsCVE-2024-5853 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirv_upload_file_by_chanks AJAX action in all versions up to, and including, 7.2.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.6
What to do
Affects up to 7.2.6. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Salon booking system: Arbitrary file uploadsCVE-2024-3229 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Salon booking system
Affected
up to 10.2
What to do
Affects up to 10.2. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024AliExpress Dropshipping with AliNext Lite: Arbitrary file uploadsCVE-2024-2381 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save_image function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
AliExpress Dropshipping with AliNext Lite
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update AliExpress Dropshipping with AliNext Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 15, 2024FooEvents for WooCommerce: Unauthorized arbitrary file uploadsCVE-2024-6000 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_ticket_themes_page' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with contributor-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in 1.19.20, and fully patched in 1.19.21.
Product
FooEvents for WooCommerce
Affected
up to 1.19.20
What to do
Affects up to 1.19.20. Update FooEvents for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record help.fooevents.com wordfence.com
Jun 14, 2024Folders Pro: Arbitrary file uploadsCVE-2024-2024 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_folders_file_upload' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Folders Pro
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Folders Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2024BuddyPress Cover: Unrestricted Upload of File with Dangerous TypeCVE-2024-35746 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Asghar Hatampoor BuddyPress Cover allows Code Injection.This issue affects BuddyPress Cover: from n/a through 2.1.4.2.
Product
BuddyPress Cover
Affected
up to 2.1.4.2
What to do
Affects up to 2.1.4.2. Update BuddyPress Cover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Upload Fields for WPForms: Missing AuthorizationCVE-2024-35661 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2.
Product
Upload Fields for WPForms
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Upload Fields for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 7, 2024ARForms - Premium WordPress Form Builder: Allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploadedCVE-2024-4620 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form
Product
ARForms - Premium WordPress Form Builder
Fixed in
6.6
What to do
Update ARForms - Premium WordPress Form Builder to 6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 6, 2024Wbcom Designs – Custom Font Uploader: Unauthorized loss of dataCVE-2024-5489 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cfu_delete_customfont' function in all versions up to, and including, 2.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete any custom font.
Product
Wbcom Designs – Custom Font Uploader
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Wbcom Designs – Custom Font Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Unrestricted Upload of File with Dangerous TypeCVE-2023-33930 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Code Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.66.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.66
What to do
Affects up to 1.5.66. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 1, 2024Uploadcare File Uploader and Adaptive Delivery (beta): Cross-Site Request Forgery (CSRF)CVE-2024-35636 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uploadcare Uploadcare File Uploader and Adaptive Delivery (beta) uploadcare.This issue affects Uploadcare File Uploader and Adaptive Delivery (beta): from n/a through 3.0.11.
Product
Uploadcare File Uploader and Adaptive Delivery (beta)
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update Uploadcare File Uploader and Adaptive Delivery (beta) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 29, 2024WP STAGING WordPress Backup Plugin – Migration Backup Restore: Arbitrary file uploadsCVE-2024-3412 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WP STAGING WordPress Backup Plugin – Migration Backup Restore
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update WP STAGING WordPress Backup Plugin – Migration Backup Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2024Hash Form – Drag & Drop Form Builder: Arbitrary file uploadsCVE-2024-5084 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Hash Form – Drag & Drop Form Builder
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Hash Form – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2024ActiveDEMAND: Unrestricted Upload of File with Dangerous TypeCVE-2024-32809 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in JumpDEMAND Inc. ActiveDEMAND allows Using Malicious Files.This issue affects ActiveDEMAND: from n/a through 0.2.41.
Product
ActiveDEMAND
Affected
up to 0.2.41
What to do
Affects up to 0.2.41. Update ActiveDEMAND to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024XStore Core: Unrestricted Upload of File with Dangerous TypeCVE-2024-33556 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.
Product
XStore Core
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024Copymatic – AI Content Writer & Generator: Unrestricted Upload of File with Dangerous TypeCVE-2024-31351 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.6.
Product
Copymatic – AI Content Writer & Generator
Affected
up to 1.6
What to do
Affects up to 1.6. Update Copymatic – AI Content Writer & Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 17, 2024JS Help Desk – Best Help Desk & Support: Unrestricted Upload of File with Dangerous TypeCVE-2023-25444 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Using Malicious Files.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.7.
Product
JS Help Desk – Best Help Desk & Support
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update JS Help Desk – Best Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2024SP Project & Document Manager: Is missing validation in its upload functionCVE-2024-3748 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Kognetiks Chatbot for: Arbitrary file uploadsCVE-2024-4560 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the chatbot_chatgpt_upload_file_to_assistant function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers, with to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Kognetiks Chatbot for
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024LearnPress – WordPress LMS: Arbitrary file uploadsCVE-2024-4397 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and including, 4.2.6.5. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.