Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

349new WordPress flaws this week

393,576entries in the database

11,333 results · page 188 of 227

Apr 11, 2024Popup Like box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31387 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Popup LikeBox Team Popup Like box allows Stored XSS.This issue affects Popup Like box: from n/a through 3.7.2.
Product
Popup Like box
Affected
up to 3.7.2
What to do
Affects up to 3.7.2. Update Popup Like box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024bunny.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31361 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.Net allows Stored XSS.This issue affects bunny.Net: from n/a through 2.0.1.
Product
bunny.Net
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update bunny.Net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Search Keyword Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32080 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Pelton Search Keyword Redirect allows Stored XSS.This issue affects Search Keyword Redirect: from n/a through 1.0.
Product
Search Keyword Redirect
Affected
up to 1.0
What to do
Affects up to 1.0. Update Search Keyword Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024submit processing: Ninja Forms prior to 3.8.1 contains a cross-site scriptingCVE-2024-26019 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
Product
submit processing
Fixed in
3.8.1
What to do
Update submit processing to 3.8.1 or newer.
Full record and what to do →NVD record jvn.jp ninjaforms.com
Apr 10, 2024Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27992 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper Link Whisper Free allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.6.8.
Product
Link Whisper Free
Affected
up to 0.6.8
What to do
Affects up to 0.6.8. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024SupportCandy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SupportCandy allows Stored XSS.This issue affects SupportCandy: from n/a through 3.2.3.
Product
SupportCandy
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024The Moneytizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27990 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Moneytizer allows Stored XSS.This issue affects The Moneytizer: from n/a through 9.5.20.
Product
The Moneytizer
Affected
up to 9.5.20
What to do
Affects up to 9.5.20. Update The Moneytizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WP Responsive Tabs horizontal vertical and accordion Tabs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27989 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs allows Stored XSS.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs: from n/a through 1.1.17.
Product
WP Responsive Tabs horizontal vertical and accordion Tabs
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update WP Responsive Tabs horizontal vertical and accordion Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WEN Responsive Columns: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2.
Product
WEN Responsive Columns
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WEN Responsive Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024PropertyHive: Deserialization of Untrusted DataCVE-2024-27985 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9.
Product
PropertyHive
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Free Downloads WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Enhanced Free Downloads WooCommerce allows Stored XSS.This issue affects Free Downloads WooCommerce: from n/a through 3.5.8.2.
Product
Free Downloads WooCommerce
Affected
up to 3.5.8.2
What to do
Affects up to 3.5.8.2. Update Free Downloads WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27966 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 8.2.2.
Product
Quiz And Survey Master
Affected
up to 8.2.2
What to do
Affects up to 8.2.2. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Cross-Site Request Forgery (CSRF)CVE-2024-31430 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional, realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: from n/a through 1.0.8.1; BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.1.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024User Activity Log: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31356 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User Activity Log: from n/a through 1.8.
Product
User Activity Log
Affected
up to 1.8
What to do
Affects up to 1.8. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Slideshow Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31355 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
Product
Slideshow Gallery
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Media Library Folders: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-31287 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8.
Product
Media Library Folders
Affected
up to 8.1.8
What to do
Affects up to 8.1.8. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WP Poll Maker: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-31240 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in InfoTheme WP Poll Maker.This issue affects WP Poll Maker: from n/a through 3.1.
Product
WP Poll Maker
Affected
up to 3.1
What to do
Affects up to 3.1. Update WP Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-3210 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'reg-single-checkbox' shortcode in all versions up to, and including, 4.15.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.15.5
What to do
Affects up to 4.15.5. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024Ultimate Video Player For WordPress: Does not have proper capability checkCVE-2024-2428 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS attacks
Product
Ultimate Video Player For WordPress
Fixed in
2.2.3
What to do
Update Ultimate Video Player For WordPress to 2.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 9, 2024The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all verCVE-2024-2738 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all versions up to, and including, 2.4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected
up to 2.4.3.1
What to do
Affects up to 2.4.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com gist.github.com
Apr 9, 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Stored Cross-Site ScriptingCVE-2024-2423 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Advanced Classifieds & Directory Pro: Unauthorized loss of dataCVE-2024-2222 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads.
Product
Advanced Classifieds & Directory Pro
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Easy Property Listings: Time-based SQL InjectionCVE-2024-1893 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Easy Property Listings
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Customily Product Personalizer: Stored Cross-Site ScriptingCVE-2024-1774 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Customily Product Personalizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via user cookies in all versions up to, and including, 1.23.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. We unfortunately could not get in touch with the vendor through various means to disclose this issue.
Product
Customily Product Personalizer
Affected
up to 1.23.3
What to do
Affects up to 1.23.3. Update Customily Product Personalizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record customily.com wordfence.com
Apr 9, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-0588 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing nonce validation on the pmpro_lifter_save_streamline_option() function. This makes it possible for unauthenticated attackers to enable the streamline setting with Lifter LMS via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-32793 and CVE-2024-32794 appear to be a duplicate of this issue.
Product
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Affected
up to 2.12.10
What to do
Affects up to 2.12.10. Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024AIKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31370 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeIsAwesome AIKit aikit-wordpress-ai-writing-assistant-using-gpt3.This issue affects AIKit: from n/a through <= 4.14.1.
Product
AIKit
Affected
up to 4.14.1
What to do
Affects up to 4.14.1. Update AIKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Post Type Builder (PTB): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31365 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Post Type Builder (PTB) allows Reflected XSS.This issue affects Post Type Builder (PTB): from n/a before 2.1.1.
Product
Post Type Builder (PTB)
Fixed in
2.1.1
What to do
Update Post Type Builder (PTB) to 2.1.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 8, 2024Ultimate Store Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31357 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.5.2.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024MailMunch – Grow your Email List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailMunch – Grow your Email List allows Stored XSS.This issue affects MailMunch – Grow your Email List: from n/a through 3.1.6.
Product
MailMunch – Grow your Email List
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update MailMunch – Grow your Email List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials allows Stored XSS.This issue affects Testimonials: from n/a through 3.0.5.
Product
Testimonials
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Gradient Text Widget for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31346 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksmarket Gradient Text Widget for Elementor allows Stored XSS.This issue affects Gradient Text Widget for Elementor: from n/a through 1.0.1.
Product
Gradient Text Widget for Elementor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Gradient Text Widget for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Easy Login Styler – White Label Admin Login Page for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31344 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phpbits Creative Studio Easy Login Styler – White Label Admin Login Page for WordPress allows Stored XSS.This issue affects Easy Login Styler – White Label Admin Login Page for WordPress: from n/a through 1.0.6.
Product
Easy Login Styler – White Label Admin Login Page for
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Easy Login Styler – White Label Admin Login Page for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Essential Blocks for Gutenberg: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31306 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Stored XSS.This issue affects Essential Blocks for Gutenberg: from n/a through 4.5.3.
Product
Essential Blocks for Gutenberg
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-31291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.
Product
ProfileGrid
Affected
up to 5.7.6
What to do
Affects up to 5.7.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Product Designer: Deserialization of Untrusted DataCVE-2024-31277 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32.
Product
Product Designer
Affected
up to 1.0.32
What to do
Affects up to 1.0.32. Update Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Edwiser Bridge: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31260 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WisdmLabs Edwiser Bridge.This issue affects Edwiser Bridge: from n/a through 3.0.2.
Product
Edwiser Bridge
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Form to Chat App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31258 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.Company Form to Chat App allows Stored XSS.This issue affects Form to Chat App: from n/a through 1.1.6.
Product
Form to Chat App
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Form to Chat App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Formsite | Embed online forms to collect orders, registrations, leads, and surveys: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formsite Formsite | Embed online forms to collect orders, registrations, leads, and surveys allows Stored XSS.This issue affects Formsite | Embed online forms to collect orders, registrations, leads, and surveys: from n/a through 1.6.
Product
Formsite | Embed online forms to collect orders, registrations, leads, and surveys
Affected
up to 1.6
What to do
Affects up to 1.6. Update Formsite | Embed online forms to collect orders, registrations, leads, and surveys to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024WebinarPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31256 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebinarPress allows Reflected XSS.This issue affects WebinarPress: from n/a through 1.33.10.
Product
WebinarPress
Affected
up to 1.33.10
What to do
Affects up to 1.33.10. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31255 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts allows Reflected XSS.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.
Product
ELEX WooCommerce Dynamic Pricing and Discounts
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024LearnPress Export Import: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31241 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress LearnPress Export Import.This issue affects LearnPress Export Import: from n/a through 4.0.3.
Product
LearnPress Export Import
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update LearnPress Export Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31236 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.3.93.
Product
Royal Elementor Addons
Affected
up to 1.3.93
What to do
Affects up to 1.3.93. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024REHub Framework: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31234 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam REHub Framework.This issue affects REHub Framework: from n/a before 19.6.2.
Product
REHub Framework
Fixed in
19.6.2
What to do
Update REHub Framework to 19.6.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Rehub: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31233 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam Rehub.This issue affects Rehub: from n/a through 19.6.1.
Product
Rehub
Affected
up to 19.6.1
What to do
Affects up to 19.6.1. Update Rehub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2024The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce pluginCVE-2024-2949 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 3, 2024Canto: Improper Control of Generation of Code ('Code Injection')CVE-2024-25096 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.
Product
Canto
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Canto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 3, 2024Cwicly: Improper Control of Generation of Code ('Code Injection')CVE-2024-24707 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Cwicly Builder, SL. Cwicly allows Code Injection.This issue affects Cwicly: from n/a through 1.4.0.2.
Product
Cwicly
Affected
up to 1.4.0.2
What to do
Affects up to 1.4.0.2. Update Cwicly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com snicco.io
Apr 3, 2024VideoWhisper Live Streaming Integration: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2023-25699 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integration allows OS Command Injection.This issue affects VideoWhisper Live Streaming Integration: from n/a through 5.5.15.
Product
VideoWhisper Live Streaming Integration
Affected
up to 5.5.15
What to do
Affects up to 5.5.15. Update VideoWhisper Live Streaming Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 3, 2024Breakdance: : Improper Control of Generation of Code ('Code Injection')CVE-2024-31390 · WordPress plugins & themes · reported by PatchstackCritical 9.9
: Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a through 1.7.2.
Product
Breakdance
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Breakdance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 3, 2024Oxygen Builder: Improper Control of Generation of Code ('Code Injection')CVE-2024-31380 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a through 4.9.
Product
Oxygen Builder
Affected
up to 4.9
What to do
Affects up to 4.9. Update Oxygen Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com snicco.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.