Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

323new WordPress flaws this week

393,460entries in the database

11,319 results · page 173 of 227

Jul 12, 2024Booking Ultra Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38717 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Booking Ultra Pro allows PHP Local File Inclusion.This issue affects Booking Ultra Pro: from n/a through 1.1.13.
Product
Booking Ultra Pro
Affected
up to 1.1.13
What to do
Affects up to 1.1.13. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024Events Calendar for Google: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38716 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blue Plugins Events Calendar for Google allows PHP Local File Inclusion.This issue affects Events Calendar for Google: from n/a through 2.1.0.
Product
Events Calendar for Google
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Events Calendar for Google to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024ExS Widgets: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38715 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExS ExS Widgets allows PHP Local File Inclusion.This issue affects ExS Widgets: from n/a through 0.3.1.
Product
ExS Widgets
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update ExS Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024GD Rating System: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38709 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Milan Petrovic GD Rating System allows PHP Local File Inclusion.This issue affects GD Rating System: from n/a through 3.6.
Product
GD Rating System
Affected
up to 3.6
What to do
Affects up to 3.6. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024WordPress Team Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38704 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DynamicWebLab WordPress Team Manager allows PHP Local File Inclusion.This issue affects WordPress Team Manager: from n/a through 2.1.12.
Product
WordPress Team Manager
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update WordPress Team Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024WPCS: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CVE-2024-38700 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in realmag777 WPCS allows Code Injection.This issue affects WPCS: from n/a through 1.2.0.3.
Product
WPCS
Affected
up to 1.2.0.3
What to do
Affects up to 1.2.0.3. Update WPCS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024Woocommerce OpenPos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37933 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anhvnit Woocommerce OpenPos.This issue affects Woocommerce OpenPos: from n/a through 6.4.4.
Product
Woocommerce OpenPos
Affected
up to 6.4.4
What to do
Affects up to 6.4.4. Update Woocommerce OpenPos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024Woocommerce OpenPos: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37932 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in anhvnit Woocommerce OpenPos allows File Manipulation.This issue affects Woocommerce OpenPos: from n/a through 6.4.4.
Product
Woocommerce OpenPos
Affected
up to 6.4.4
What to do
Affects up to 6.4.4. Update Woocommerce OpenPos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024Jobmonster: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37928 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NooTheme Jobmonster allows File Manipulation.This issue affects Jobmonster: from n/a through 4.7.0.
Product
Jobmonster
Affected
up to 4.7.0
What to do
Affects up to 4.7.0. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024PayPlus Payment Gateway: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37564 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PayPlus LTD PayPlus Payment Gateway.This issue affects PayPlus Payment Gateway: from n/a through 7.0.7.
Product
PayPlus Payment Gateway
Affected
up to 7.0.7
What to do
Affects up to 7.0.7. Update PayPlus Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024WP User Switch: Improper Privilege ManagementCVE-2024-37560 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Privilege Management vulnerability in IqbalRony WP User Switch allows Privilege Escalation.This issue affects WP User Switch: from n/a through 1.1.0.
Product
WP User Switch
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WP User Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024Quotes and Tips by BestWebSoft: Does not properly validate image files uploadedCVE-2024-3112 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
Quotes and Tips by BestWebSoft
Fixed in
1.45
What to do
Update Quotes and Tips by BestWebSoft to 1.45 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2024Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2024-6138 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Secure Copy Content Protection and Content Locking
Fixed in
4.0.9
What to do
Update Secure Copy Content Protection and Content Locking to 4.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2024ProfileGrid – User Profiles, Groups and Communities: Privilege escalationCVE-2024-6411 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pm_upload_image' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their user capabilities to Administrator.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.8.9
What to do
Affects up to 5.8.9. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2024ProfileGrid – User Profiles, Groups and Communities: Insecure Direct Object ReferenceCVE-2024-6410 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pm_upload_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the profile picture of any user.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.8.9
What to do
Affects up to 5.8.9. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024BookYourTravel: Improper Privilege ManagementCVE-2024-37952 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18.17.
Product
BookYourTravel
Affected
up to 8.18.17
What to do
Affects up to 8.18.17. Update BookYourTravel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Ninja Forms: Improper Control of Generation of Code ('Code Injection')CVE-2024-37934 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4.
Product
Ninja Forms
Affected
up to 3.8.4
What to do
Affects up to 3.8.4. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024ShopBuilder – Elementor WooCommerce Builder Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-37520 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 2.1.12.
Product
ShopBuilder – Elementor WooCommerce Builder Addons
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024WPCafe: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37513 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPCafe: from n/a through 2.2.27.
Product
WPCafe
Affected
up to 2.2.27
What to do
Affects up to 2.2.27. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Advanced Classifieds & Directory Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37501 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginsWare Advanced Classifieds & Directory Pro allows Path Traversal.This issue affects Advanced Classifieds & Directory Pro: from n/a through 3.1.3.
Product
Advanced Classifieds & Directory Pro
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Online Booking & Scheduling Calendar for WordPress by vcita: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37499 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online Booking & Scheduling Calendar for WordPress by vcita allows Path Traversal.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.2.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024JetThemeCore: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37497 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetThemeCore jet-theme-core.This issue affects JetThemeCore: from n/a through < 2.2.1.
Product
JetThemeCore
What to do
Update JetThemeCore to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Zephyr Project Manager: Improper Privilege ManagementCVE-2024-37484 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Dylan James Zephyr Project Manager allows Privilege Escalation.This issue affects Zephyr Project Manager: from n/a through 3.3.97.
Product
Zephyr Project Manager
Affected
up to 3.3.97
What to do
Affects up to 3.3.97. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Beaver Builder Addons by WPZOOM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37464 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPZOOM Beaver Builder Addons by WPZOOM allows Path Traversal.This issue affects Beaver Builder Addons by WPZOOM: from n/a through 1.3.5.
Product
Beaver Builder Addons by WPZOOM
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Beaver Builder Addons by WPZOOM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Ultimate Bootstrap Elements for Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37462 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows Path Traversal.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.2.
Product
Ultimate Bootstrap Elements for Elementor
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Ultimate Bootstrap Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Ultimate Addons for Elementor: Improper Privilege ManagementCVE-2024-37455 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31.
Product
Ultimate Addons for Elementor
Affected
up to 1.36.31
What to do
Affects up to 1.36.31. Update Ultimate Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024AWSM Team: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AWSM Innovations AWSM Team allows Path Traversal.This issue affects AWSM Team: from n/a through 1.3.1.
Product
AWSM Team
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update AWSM Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Photo Gallery by Ays: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CVE-2024-37442 · WordPress plugins & themes · reported by PatchstackLow 3.8
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1.
Product
Photo Gallery by Ays
Fixed in
5.7.1
What to do
Update Photo Gallery by Ays to 5.7.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37437 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor.This issue affects Elementor Website Builder: from n/a through <= 3.22.1.
Product
Elementor Website Builder
Affected
up to 3.22.1
What to do
Affects up to 3.22.1. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Cowidgets – Elementor Addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37419 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Codeless Cowidgets – Elementor Addons allows Path Traversal.This issue affects Cowidgets – Elementor Addons: from n/a through 1.1.1.
Product
Cowidgets – Elementor Addons
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Cowidgets – Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024PowerPack Lite for Beaver Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-37410 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder.This issue affects PowerPack Lite for Beaver Builder: from n/a through <= 1.3.0.3.
Product
PowerPack Lite for Beaver Builder
Affected
up to 1.3.0.3
What to do
Affects up to 1.3.0.3. Update PowerPack Lite for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Striking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37268 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kaptinlin Striking allows Path Traversal.This issue affects Striking: from n/a through 2.3.4.
Product
Striking
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Striking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Tutor LMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37266 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1.
Product
Tutor LMS
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024WP Directory Kit: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CVE-2024-37253 · WordPress plugins & themes · reported by PatchstackLow 2.7
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6.
Product
WP Directory Kit
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024SP Project & Document Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37224 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.71.
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Masterstudy Elementor Widgets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37090 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThemes Consulting Elementor Widgets.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2; Consulting Elementor Widgets: from n/a through 1.3.0.
Product
Masterstudy Elementor Widgets
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024WooCommerce: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CVE-2024-35777 · WordPress plugins & themes · reported by PatchstackLow 3.5
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2.
Product
WooCommerce
Affected
up to 8.9.2
What to do
Affects up to 8.9.2. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress CVE-2024-6069 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server
Affected
up to 3.8.3.4
What to do
Affects up to 3.8.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ: Unauthorized modification of dataCVE-2024-5704 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e. ffw_insert_new_faq, ffw_hide_discount_notice, ffw_delete_all_faqs, ffw_delete_single_faq, etc...) in all versions up to, and including, 1.7.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to add new and update existing FAQs, FAQ lists, and modify FAQ associations with products.
Product
XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin]: Unauthorized modification of dataCVE-2024-5669 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ffw_activate_template' function in all versions up to, and including, 1.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store cross-site scripting that will trigger when viewing the dashboard templates or accessing FAQs.
Product
XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin]
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Product Designer: Unauthorized loss of dataCVE-2024-3608 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue.
Product
Product Designer
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Youzify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37494 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a through 1.2.5.
Product
Youzify
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Youzify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Paid Memberships Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37486 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.
Product
Paid Memberships Pro
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37256 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1.
Product
Tutor LMS
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024Zoho Marketing Automation: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37225 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Marketing Automation.This issue affects Zoho Marketing Automation: from n/a through 1.2.7.
Product
Zoho Marketing Automation
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Zoho Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024WishList Member X: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37112 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024SEOPress: Does not properly protect some of its REST API routesCVE-2024-5488 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
Product
SEOPress
Fixed in
7.9
What to do
Update SEOPress to 7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 9, 2024Product Table by WBW: Remote Code ExecutionCVE-2024-6365 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' function. This is due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file. This makes it possible for unauthenticated attackers to execute code on the server.
Product
Product Table by WBW
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 6, 2024UltraAddons Elementor Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37554 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows DOM-Based XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.
Product
UltraAddons Elementor Lite
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update UltraAddons Elementor Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 6, 2024Testimonials Widget: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37553 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4.
Product
Testimonials Widget
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update Testimonials Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.