Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

317new WordPress flaws this week

393,460entries in the database

11,319 results · page 177 of 227

Jun 4, 2024Userpro: Incorrect Privilege AssignmentCVE-2024-35700 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.8.
Product
Userpro
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue allows Reflected XSS.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.77.
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Affected
up to 3.1.77
What to do
Affects up to 3.1.77. Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Themesflat Addons For Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35666 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themesflat Themesflat Addons For Elementor allows Stored XSS.This issue affects Themesflat Addons For Elementor: from n/a through 2.1.2.
Product
Themesflat Addons For Elementor
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WPvivid Backup for MainWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35664 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpvividplugins WPvivid Backup for MainWP wpvivid-backup-mainwp allows Reflected XSS.This issue affects WPvivid Backup for MainWP: from n/a through <= 0.9.32.
Product
WPvivid Backup for MainWP
Affected
up to 0.9.32
What to do
Affects up to 0.9.32. Update WPvivid Backup for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Brave: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35655 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave brave-popup-builder allows DOM-Based XSS.This issue affects Brave: from n/a through <= 0.6.9.
Product
Brave
Affected
up to 0.6.9
What to do
Affects up to 0.6.9. Update Brave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Responsive: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35654 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive allows Stored XSS.This issue affects Responsive: from n/a through 5.0.3.
Product
Responsive
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Woocommerce – Recent Purchases: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35634 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wow-Company Woocommerce – Recent Purchases allows PHP Local File Inclusion.This issue affects Woocommerce – Recent Purchases: from n/a through 1.0.1.
Product
Woocommerce – Recent Purchases
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Woocommerce – Recent Purchases to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Easy Digital Downloads – Recent Purchases: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-35629 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads – Recent Purchases allows PHP Remote File Inclusion.This issue affects Easy Digital Downloads – Recent Purchases: from n/a through 1.0.2.
Product
Easy Digital Downloads – Recent Purchases
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Easy Digital Downloads – Recent Purchases to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Dextaz Ping: Improper Neutralization of Special Elements used in a Command ('Command Injection')CVE-2024-34792 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in dexta Dextaz Ping allows Command Injection.This issue affects Dextaz Ping: from n/a through 0.65.
Product
Dextaz Ping
Affected
up to 0.65
What to do
Affects up to 0.65. Update Dextaz Ping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Stockholm Core: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-34554 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm Core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through 2.4.1.
Product
Stockholm Core
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Stockholm Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Stockholm: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-34552 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through 9.6.
Product
Stockholm
Affected
up to 9.6
What to do
Affects up to 9.6. Update Stockholm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Stockholm: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-34551 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through 9.6.
Product
Stockholm
Affected
up to 9.6
What to do
Affects up to 9.6. Update Stockholm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Sina Extension for Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-34384 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SinaExtra Sina Extension for Elementor allows PHP Local File Inclusion.This issue affects Sina Extension for Elementor: from n/a through 3.5.1.
Product
Sina Extension for Elementor
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Sina Extension for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024XforWooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-33628 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in XforWooCommerce allows PHP Local File Inclusion.This issue affects XforWooCommerce: from n/a through 2.0.2.
Product
XforWooCommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update XforWooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Element Pack Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted DataCVE-2024-33568 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3.
Product
Element Pack Pro
Fixed in
7.19.3
What to do
Update Element Pack Pro to 7.19.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024XStore: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-33560 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore allows PHP Local File Inclusion.This issue affects XStore: from n/a through 9.3.8.
Product
XStore
Affected
up to 9.3.8
What to do
Affects up to 9.3.8. Update XStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024XStore Core: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-33557 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore Core allows PHP Local File Inclusion.This issue affects XStore Core: from n/a through 5.3.8.
Product
XStore Core
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Better Elementor Addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-33541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BetterAddons Better Elementor Addons allows PHP Local File Inclusion.This issue affects Better Elementor Addons: from n/a through 1.4.1.
Product
Better Elementor Addons
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Better Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Bricks Builder: Improper Control of Generation of Code ('Code Injection')CVE-2024-25600 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6.
Product
Bricks Builder
Affected
up to 1.9.6
What to do
Affects up to 1.9.6. Update Bricks Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jun 4, 2024RegistrationMagic: Improper Control of Interaction FrequencyCVE-2023-51544 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Interaction Frequency vulnerability in Metagauss RegistrationMagic allows Functionality Misuse.This issue affects RegistrationMagic: from n/a through 5.2.5.0.
Product
RegistrationMagic
Affected
up to 5.2.5.0
What to do
Affects up to 5.2.5.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Booster Elite for WooCommerce: Improper AuthenticationCVE-2023-51511 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Authentication vulnerability in Pluggabl LLC Booster Elite for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.3.
Product
Booster Elite for WooCommerce
Fixed in
7.1.3
What to do
Update Booster Elite for WooCommerce to 7.1.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Responsive Slick Slider: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-49852 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vsourz Digital Responsive Slick Slider WordPress allows Code Injection.This issue affects Responsive Slick Slider WordPress: from n/a through 1.4.
Product
Responsive Slick Slider
Affected
up to 1.4
What to do
Affects up to 1.4. Update Responsive Slick Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Booster for WooCommerce: Improper AuthenticationCVE-2023-48747 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Authentication vulnerability in Pluggabl LLC Booster for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster for WooCommerce: from n/a through 7.1.2.
Product
Booster for WooCommerce
Affected
up to 7.1.2
What to do
Affects up to 7.1.2. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Captcha Code: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48745 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9.
Product
Captcha Code
Affected
up to 2.9
What to do
Affects up to 2.9. Update Captcha Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Contact Form Email: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48318 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.
Product
Contact Form Email
Affected
up to 1.3.41
What to do
Affects up to 1.3.41. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Form Maker by 10Web: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48290 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20.
Product
Form Maker by 10Web
Affected
up to 1.15.20
What to do
Affects up to 1.15.20. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Stripe Payments: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-48285 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through 2.0.79.
Product
Stripe Payments
Affected
up to 2.0.79
What to do
Affects up to 2.0.79. Update Stripe Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Forms Puzzle Captcha: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
Product
WP Forms Puzzle Captcha
Affected
up to 4.1
What to do
Affects up to 4.1. Update WP Forms Puzzle Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024ARMember: Improper Privilege ManagementCVE-2023-47837 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.
Product
ARMember
Affected
up to 4.0.10
What to do
Affects up to 4.0.10. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024ARI Stream Quiz: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-47513 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affects ARI Stream Quiz: from n/a through 1.3.2.
Product
ARI Stream Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update ARI Stream Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Defender Security: Improper AuthenticationCVE-2023-47189 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.
Product
Defender Security
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Admin and Site Enhancements (ASE): Improper AuthenticationCVE-2023-46630 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Authentication vulnerability in wpase Admin and Site Enhancements (ASE) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Admin and Site Enhancements (ASE): from n/a through 5.7.1.
Product
Admin and Site Enhancements (ASE)
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024wpDiscuz: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-46310 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.This issue affects wpDiscuz: from n/a through 7.6.10.
Product
wpDiscuz
Affected
up to 7.6.10
What to do
Affects up to 7.6.10. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Responsive Tabs: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-45635 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injection.This issue affects Responsive Tabs: from n/a before 4.0.6.
Product
Responsive Tabs
Fixed in
4.0.6
What to do
Update Responsive Tabs to 4.0.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Content Pilot – Autoblogging & Affiliate Marketing: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-45053 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing Plugin allows Code Injection.This issue affects WP Content Pilot – Autoblogging & Affiliate Marketing Plugin: from n/a through 1.3.3.
Product
WP Content Pilot – Autoblogging & Affiliate Marketing
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update WP Content Pilot – Autoblogging & Affiliate Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Captcha/Honeypot for Contact Form 7: Improper Restriction of Excessive Authentication AttemptsCVE-2023-45009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Forge12 Interactive GmbH Captcha/Honeypot for Contact Form 7 allows Functionality Bypass.This issue affects Captcha/Honeypot for Contact Form 7: from n/a through 1.11.3.
Product
Captcha/Honeypot for Contact Form 7
Affected
up to 1.11.3
What to do
Affects up to 1.11.3. Update Captcha/Honeypot for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP Captcha: Improper Restriction of Excessive Authentication AttemptsCVE-2023-44235 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Devnath verma WP Captcha allows Functionality Bypass.This issue affects WP Captcha: from n/a through 2.0.0.
Product
WP Captcha
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Cartpauj Register Captcha: : Improper Control of Interaction FrequencyCVE-2023-40673 · WordPress plugins & themes · reported by PatchstackMedium 6.5
: Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.
Product
Cartpauj Register Captcha
Affected
up to 1.0.02
What to do
Affects up to 1.0.02. Update Cartpauj Register Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Tabs & Accordion: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-40557 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Injection.This issue affects Tabs & Accordion: from n/a through 1.3.10.
Product
Tabs & Accordion
Affected
up to 1.3.10
What to do
Affects up to 1.3.10. Update Tabs & Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024WP-PostRatings: Improper Control of Interaction FrequencyCVE-2023-40332 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.
Product
WP-PostRatings
Affected
up to 1.91
What to do
Affects up to 1.91. Update WP-PostRatings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Discussion Board: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-39161 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Discussion Board Discussion Board allows Content Spoofing, Cross-Site Scripting (XSS).This issue affects Discussion Board: from n/a through 2.4.8.
Product
Discussion Board
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Hide My WP Ghost: Improper Restriction of Excessive Authentication AttemptsCVE-2023-34001 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in WPPlugins – WordPress Security Plugins Hide My WP Ghost allows Functionality Bypass.This issue affects Hide My WP Ghost: from n/a through 5.0.25.
Product
Hide My WP Ghost
Affected
up to 5.0.25
What to do
Affects up to 5.0.25. Update Hide My WP Ghost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024FS Product Inquiry: Does not sanitise and escape some form submissionsCVE-2024-4857 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape some form submissions, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
Product
FS Product Inquiry
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update FS Product Inquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024FS Product Inquiry: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4856 · WordPress plugins & themes · reported by WPScanHigh 8.2
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
Product
FS Product Inquiry
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update FS Product Inquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024Events Calendar: Does not properly sanitize user-submitted contentCVE-2024-4180 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.
Product
Events Calendar
Fixed in
6.4.0.1
What to do
Update Events Calendar to 6.4.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 4, 2024Social Link Pages: link-in-bio landing pages for your social media profiles: Unauthorized accessCVE-2024-3555 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Social Link Pages: link-in-bio landing pages for your social media profiles plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the import_link_pages() function in all versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to inject arbitrary pages and malicious web scripts.
Product
Social Link Pages: link-in-bio landing pages for your social media profiles
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Social Link Pages: link-in-bio landing pages for your social media profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 4, 2024Insert or Embed Articulate Content into: Is not properly filteringCVE-2024-0757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files
Product
Insert or Embed Articulate Content into
Affected
up to 4.3000000023
What to do
Affects up to 4.3000000023. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 3, 2024Spectra: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CVE-2023-23738 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Brainstorm Force Spectra allows Content Spoofing, Phishing.This issue affects Spectra: from n/a through 2.3.0.
Product
Spectra
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Spectra: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-23735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affects Spectra: from n/a through 2.3.0.
Product
Spectra
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024Spectra: Improper Restriction of Excessive Authentication AttemptsCVE-2023-23730 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: from n/a through 2.3.0.
Product
Spectra
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.