Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,714entries in the database

73 results · page 2 of 2

Jul 1, 2024Basil recipe: Persistent Cross-Site Scripting (XSS)CVE-2024-39310 · WordPress plugins & themes · reported by GitHubMedium 5.4
The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue.
Product
Basil recipe
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Basil recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jun 19, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2024-0383 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [wprm-recipe-instructions] and [wprm-recipe-ingredients] shortcodes in all versions up to, and including, 9.1.0 due to insufficient restrictions on the 'group_tag' attribute . This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2024Cooked Pro recipe: Persistent Cross-Site Scripting (XSS)CVE-2024-37308 · WordPress plugins & themes · reported by GitHubMedium 5.4
The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. A patch is available at commit 8cf88f334ccbf11134080bbb655c66f1cfe77026 and will be part of version 1.8.0.
Product
Cooked Pro recipe
Affected
up to 1.7.15.4
What to do
Affects up to 1.7.15.4. Update Cooked Pro recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
May 2, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2024-3490 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in all versions up to, and including, 9.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.3.1
What to do
Affects up to 9.3.1. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2024-1571 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the recipe dashboard (which is administrator-only by default but can be assigned to arbitrary capabilities), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.2.1
What to do
Affects up to 9.2.1. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024WP Recipe Maker: SQL InjectionCVE-2024-1206 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up to, and including, 9.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Recipe Maker
Affected
up to 9.1.2
What to do
Affects up to 9.1.2. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2024-0384 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Notes in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2024-0382 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to unrestricted use of the 'header_tag' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024WP Recipe Maker: Directory TraversalCVE-2024-0380 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' attribute used in Shortcodes. This makes it possible for authenticated attackers, with contributor-level access and above, to include the contents of SVG files on the server, which can be leveraged for Cross-Site Scripting.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2024-0255 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-recipe-text-share' shortcode in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 18, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2024-0381 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 18, 2024WP Recipe Maker: Reflected Cross-Site ScriptingCVE-2023-6970 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2023-6958 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 31, 2023Recipe Maker For Your Food Blog from Zip Recipes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52180 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes.This issue affects Recipe Maker For Your Food Blog from Zip Recipes: from n/a through 8.1.0.
Product
Recipe Maker For Your Food Blog from Zip Recipes
Affected
up to 8.1.0
What to do
Affects up to 8.1.0. Update Recipe Maker For Your Food Blog from Zip Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in EasyRecipe plugin <= 3.5.3251 versions.CVE-2023-46779 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in EasyRecipe plugin <= 3.5.3251 versions.
Affected
up to 3.5.3251
What to do
Affects up to 3.5.3251. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.7 versions.CVE-2023-35089 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.7 versions.
Fixed in
8.0.8
What to do
Update the plugin to 8.0.8 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 9, 2023WP Recipe Maker: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4468 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Product
WP Recipe Maker
Fixed in
8.6.1
What to do
Update WP Recipe Maker to 8.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Cooked Pro: Does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore actionCVE-2022-3900 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.
Product
Cooked Pro
Fixed in
1.7.5.7
What to do
Update Cooked Pro to 1.7.5.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.CVE-2022-37338 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not properly sanitise or escape some of the properties of the Recipe Card Block (suchCVE-2021-24634 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
Product
Recipe Card Blocks by WPZOOM
Fixed in
2.8.3
What to do
Update Recipe Card Blocks by WPZOOM to 2.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not escape the message parameter before outputting it back in the admin dashboardCVE-2021-24632 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Recipe Card Blocks by WPZOOM
Fixed in
2.8.1
What to do
Update Recipe Card Blocks by WPZOOM to 2.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2019The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.CVE-2019-15836 · WordPress plugins & themes · reported by MITREMedium 5.4
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.
Product
wp-ultimate-recipe
Fixed in
3.12.7
What to do
Update wp-ultimate-recipe to 3.12.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 10, 2016Reflected XSS in wordpress plugin recipes-writer v1.0.4CVE-2016-1000147 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin recipes-writer v1.0.4
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.