Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

106 results · page 2 of 3

Mar 28, 2025NertWorks All in One Social Share Tools: Cross-Site Request Forgery (CSRF)CVE-2025-31447 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in nertworks NertWorks All in One Social Share Tools nertworks-all-in-one-social-share-tools allows Cross Site Request Forgery.This issue affects NertWorks All in One Social Share Tools: from n/a through <= 1.26.
Product
NertWorks All in One Social Share Tools
Affected
up to 1.26
What to do
Affects up to 1.26. Update NertWorks All in One Social Share Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025GDPR Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26537 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rolomak GDPR Tools gdpr-tools allows Stored XSS.This issue affects GDPR Tools: from n/a through <= 1.0.2.
Product
GDPR Tools
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update GDPR Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025SEO Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13853 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
SEO Tools
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 13, 2025Chalet-Montagne.com Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12586 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Chalet-Montagne.com Tools
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Chalet-Montagne.com Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 13, 2025Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized loss of dataCVE-2024-13229 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the update_metadata() function in all versions up to, and including, 1.0.235. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete any schema metadata assigned to any post.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.235
What to do
Affects up to 1.0.235. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 13, 2025Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Stored Cross-Site ScriptingCVE-2024-13227 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Rank Math API in all versions up to, and including, 1.0.235 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.235
What to do
Affects up to 1.0.235. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 31, 2025Affiliate Tools Việt Nam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gavin Affiliate Tools Việt Nam affiliate-tools-viet-nam allows Reflected XSS.This issue affects Affiliate Tools Việt Nam: from n/a through <= 0.3.17.
Product
Affiliate Tools Việt Nam
Affected
up to 0.3.17
What to do
Affects up to 0.3.17. Update Affiliate Tools Việt Nam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025QuoteMedia Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23644 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in justin.kuepper QuoteMedia Tools quotemedia-tools allows DOM-Based XSS.This issue affects QuoteMedia Tools: from n/a through <= 1.0.
Product
QuoteMedia Tools
Affected
up to 1.0
What to do
Affects up to 1.0. Update QuoteMedia Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Biltorvet Dealer Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22580 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Auto IT Biltorvet Dealer Tools biltorvet-dealer-tools allows Stored XSS.This issue affects Biltorvet Dealer Tools: from n/a through <= 1.0.22.
Product
Biltorvet Dealer Tools
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update Biltorvet Dealer Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024LabelGrid Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54341 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LabelGrid LabelGrid Tools label-grid-tools allows Reflected XSS.This issue affects LabelGrid Tools: from n/a through <= 1.3.58.
Product
LabelGrid Tools
Affected
up to 1.3.58
What to do
Affects up to 1.3.58. Update LabelGrid Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 2, 2024Tailored Tools: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52503 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tailored Media Tailored Tools tailored-tools allows Stored XSS.This issue affects Tailored Tools: from n/a through <= 1.8.4.
Product
Tailored Tools
Affected
up to 1.8.4
What to do
Affects up to 1.8.4. Update Tailored Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024MDR Webmaster Tools: Cross-Site Request Forgery (CSRF)CVE-2024-51640 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Matt Rude MDR Webmaster Tools mdr-webmaster-tools allows Stored XSS.This issue affects MDR Webmaster Tools: from n/a through <= 1.1.
Product
MDR Webmaster Tools
Affected
up to 1.1
What to do
Affects up to 1.1. Update MDR Webmaster Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 16, 2024BasePress Migration Tools: Unrestricted Upload of File with Dangerous TypeCVE-2024-52407 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in BasePress BasePress Migration Tools basepress-migration-tools allows Upload a Web Shell to a Web Server.This issue affects BasePress Migration Tools: from n/a through <= 1.0.0.
Product
BasePress Migration Tools
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update BasePress Migration Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024Client Power Tools Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Glover Client Power Tools Portal client-power-tools allows Reflected XSS.This issue affects Client Power Tools Portal: from n/a through <= 1.9.0.
Product
Client Power Tools Portal
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Client Power Tools Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 5, 2024Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: PHP Object InjectionCVE-2024-9314 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'set_redirections' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.228
What to do
Affects up to 1.0.228. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 5, 2024Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized modification and loss of dataCVE-2024-9161 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.228
What to do
Affects up to 1.0.228. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2024Common Tools for Site: Stored Cross-Site ScriptingCVE-2024-9115 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Common Tools for Site
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Common Tools for Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 28, 2024Pagerank tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5730 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Pagerank tools
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Pagerank tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2024WP Tools: Missing AuthorizationCVE-2022-43453 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Bill Minozzi WP Tools.This issue affects WP Tools: from n/a through 3.41.
Product
WP Tools
Affected
up to 3.41
What to do
Affects up to 3.41. Update WP Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 6, 2024WooCommerce Tools: Unauthorized modification of dataCVE-2024-1689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_module() function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to deactivate arbitrary plugin modules.
Product
WooCommerce Tools
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WooCommerce Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!: Stored Cross-Site ScriptingCVE-2024-5485 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Trigger Link shortcode in all versions up to, and including, 1.0.47 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!
Affected
up to 1.0.47
What to do
Affects up to 1.0.47. Update SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 22, 2024WP DSGVO Tools (GDPR): Stored Cross-Site ScriptingCVE-2024-3201 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pp_link' shortcode in all versions up to, and including, 3.1.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP DSGVO Tools (GDPR)
Affected
up to 3.1.32
What to do
Affects up to 3.1.32. Update WP DSGVO Tools (GDPR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 16, 2024Rank Math SEO with AI Best SEO Tools: Stored Cross-Site ScriptingCVE-2024-4617 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in versions up to, and including, 1.0.218 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rank Math SEO with AI Best SEO Tools
Affected
up to 1.0.218
What to do
Affects up to 1.0.218. Update Rank Math SEO with AI Best SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024Rank Math SEO with AI Best SEO Tools: Stored Cross-Site ScriptingCVE-2024-4335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textAlign’ parameter in versions up to, and including, 1.0.217 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rank Math SEO with AI Best SEO Tools
Affected
up to 1.0.217
What to do
Affects up to 1.0.217. Update Rank Math SEO with AI Best SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 23, 2024Rank Math SEO with AI SEO Tools: Stored Cross-Site ScriptingCVE-2024-3665 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's HowTo and FAQ widgets in all versions up to, and including, 1.0.216 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rank Math SEO with AI SEO Tools
Affected
up to 1.0.216
What to do
Affects up to 1.0.216. Update Rank Math SEO with AI SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Rank Math SEO with AI SEO Tools: Stored Cross-Site ScriptingCVE-2024-2536 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HowTo block attributes in all versions up to, and including, 1.0.214 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rank Math SEO with AI SEO Tools
Affected
up to 1.0.214
What to do
Affects up to 1.0.214. Update Rank Math SEO with AI SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 1, 2024affiliate-toolkit: Lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiverCVE-2023-5877 · WordPress plugins & themes · reported by WPScanCritical 9.8
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.
Product
affiliate-toolkit
Fixed in
3.4.3
What to do
Update affiliate-toolkit to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2023SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!: Cross-Site Request Forgery (CSRF)CVE-2023-49749 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SureTriggers SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!.This issue affects SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!: from n/a through 1.0.23.
Product
SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.3.1 versions.CVE-2023-27453 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.3.1 versions.
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 13, 2023Webmaster Tools: Cross-Site Request Forgery (CSRF)CVE-2023-46092 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.Com Webmaster Tools allows Stored XSS.This issue affects Webmaster Tools: from n/a through 2.0.
Product
Webmaster Tools
Affected
up to 2.0
What to do
Affects up to 2.0. Update Webmaster Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.4.1 versions.CVE-2023-35774 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.4.1 versions.
Fixed in
2.4.2
What to do
Update the plugin to 2.4.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 6, 2023WP DSGVO Tools (GDPR): Stored Cross-Site ScriptingCVE-2021-4358 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP DSGVO Tools (GDPR)
Affected
up to 3.1.23
What to do
Affects up to 3.1.23. Update WP DSGVO Tools (GDPR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
May 30, 2023Elementor Website Builder: Does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statementCVE-2023-0329 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
Product
Elementor Website Builder
Fixed in
3.12.2
What to do
Update Elementor Website Builder to 3.12.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 2, 2023StagTools: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0891 · WordPress plugins & themes · reported by WPScanMedium 5.4
The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
StagTools
Fixed in
2.3.7
What to do
Update StagTools to 2.3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3881 · WordPress plugins & themes · reported by WPScanMedium 5.7
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Product
WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log
Fixed in
3.43
What to do
Update WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log to 3.43 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 14, 2022Webmaster Tools Verification: Does not have authorisation and CSRF checksCVE-2022-3538 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
Product
Webmaster Tools Verification
Affected
up to 1.2
What to do
Affects up to 1.2. Update Webmaster Tools Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022myCred: Does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX actionCVE-2022-1092 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog
Product
myCred
Fixed in
2.4.3.1
What to do
Update myCred to 2.4.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022myCred: Does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX actionCVE-2022-0363 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
Product
myCred
Fixed in
2.4.3.1
What to do
Update myCred to 2.4.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022myCred: Does not have any authorisation in place in its mycred-tools-select-user AJAX actionCVE-2022-0287 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog
Product
myCred
Fixed in
2.4.4.1
What to do
Update myCred to 2.4.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022LabTools: Does not have proper authorisation and CSRF check in placeCVE-2021-25097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
Product
LabTools
Affected
up to 1.0
What to do
Affects up to 1.0. Update LabTools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 5, 2021WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenCVE-2021-42359 · WordPress plugins & themes · reported by WordfenceHigh 7.5
WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.
Affected
up to 3.1.23
What to do
Affects up to 3.1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Sep 13, 2021Comment Link Remove and Other Comment Tools: Does not have CSRF check in its 'Delete comments easily'CVE-2021-24725 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments
Product
Comment Link Remove and Other Comment Tools
Fixed in
2.1.6
What to do
Update Comment Link Remove and Other Comment Tools to 2.1.6 or newer.
Full record and what to do →NVD record wpscan.com trustwave.com
Aug 2, 2021Import feature of the RSVPMaker: (/wp-admin/toolsCVE-2021-24371 · WordPress plugins & themes · reported by WPScanLow 2.7
The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.
Product
Import feature of the RSVPMaker
Fixed in
8.7.3
What to do
Update Import feature of the RSVPMaker to 8.7.3 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
May 24, 2021The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilCVE-2021-24307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.
Fixed in
4.1.0.2
What to do
Update the plugin to 4.1.0.2 or newer.
Full record and what to do →NVD record aioseo.com wpscan.com
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · WordPress plugins & themes · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.8.8
What to do
Update Tutor LMS – eLearning and online course solution to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2019The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.CVE-2015-9401 · WordPress plugins & themes · reported by MITREMedium 4.8
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
Product
websimon-tables
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update websimon-tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.CVE-2015-9398 · WordPress plugins & themes · reported by MITREHigh 8.8
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
Product
gocodes
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update gocodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 20, 2019The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.CVE-2015-9397 · WordPress plugins & themes · reported by MITREMedium 5.4
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Product
gocodes
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update gocodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 17, 2019The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.CVE-2016-10983 · WordPress plugins & themes · reported by MITREMedium 6.5
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
Product
ghost
Fixed in
0.5.6
What to do
Update ghost to 0.5.6 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 13, 2019The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.CVE-2016-10944 · WordPress plugins & themes · reported by MITREHigh 8.8
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
Product
multisite-post-duplicator
Fixed in
1.1.3
What to do
Update multisite-post-duplicator to 1.1.3 or newer.
Full record and what to do →NVD record advisories.dxw.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.