Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

122 results · page 2 of 3

May 19, 2025TI WooCommerce Wishlist: Unrestricted Upload of File with Dangerous TypeCVE-2025-47577 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.
Product
TI WooCommerce Wishlist
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025TI WooCommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32920 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
Product
TI WooCommerce Wishlist
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48237 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.2.
Product
Wishlist for WooCommerce
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Wishlist: Missing AuthorizationCVE-2025-31063 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in redqteam Wishlist wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist: from n/a through <= 2.1.0.
Product
Wishlist
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Wishlist: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31062 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in redqteam Wishlist wishlist allows Retrieve Embedded Sensitive Data.This issue affects Wishlist: from n/a through <= 2.1.0.
Product
Wishlist
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album componentsCVE-2025-29746 · Other software · Benjaminjonard · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components
Product
Koillection
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Apr 17, 2025Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24655 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Reflected XSS.This issue affects Wishlist: from n/a through <= 1.0.39.
Product
Wishlist
Affected
up to 1.0.39
What to do
Affects up to 1.0.39. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Wishlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32618 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.46.
Product
Wishlist
Affected
up to 1.0.46
What to do
Affects up to 1.0.46. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025JetCompareWishlist: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22279 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetCompareWishlist jet-compare-wishlist allows PHP Local File Inclusion.This issue affects JetCompareWishlist: from n/a through <= 1.5.9.
Product
JetCompareWishlist
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update JetCompareWishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Wishlist: Cross-Site Request Forgery (CSRF)CVE-2025-32272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Wishlist wishlist allows Cross Site Request Forgery.This issue affects Wishlist: from n/a through <= 1.0.46.
Product
Wishlist
Affected
up to 1.0.46
What to do
Affects up to 1.0.46. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Better WishList API: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30798 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API better-wlm-api allows Reflected XSS.This issue affects Better WishList API: from n/a through <= 1.1.4.
Product
Better WishList API
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Better WishList API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025MC Woocommerce Wishlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30879 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows SQL Injection.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.8.9.
Product
MC Woocommerce Wishlist
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update MC Woocommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WishSuite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30820 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins WishSuite wishsuite allows PHP Local File Inclusion.This issue affects WishSuite: from n/a through <= 1.4.4.
Product
WishSuite
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update WishSuite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 14, 2025A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersControCVE-2025-2304 · Other software · owen2345 · reported by vulnreport@tenable.comCritical 9.4
A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
Product
camaleon-cms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com tenable.com
Mar 7, 2025Wishlist for WooCommerce: Multi Wishlists Per Customer: Cross-Site Request ForgeryCVE-2024-13774 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'save_to_multiple_wishlist' function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Wishlist for WooCommerce: Multi Wishlists Per Customer
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update Wishlist for WooCommerce: Multi Wishlists Per Customer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025Wishlist: Stored Cross-Site ScriptingCVE-2024-12809 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishlist_button' shortcode in all versions up to, and including, 1.0.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wishlist
Affected
up to 1.0.43
What to do
Affects up to 1.0.43. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2025Wishlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26915 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.41.
Product
Wishlist
Affected
up to 1.0.41
What to do
Affects up to 1.0.41. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later: Cross-Site Request ForgeryCVE-2024-13718 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.26. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to modify/update/create other user's wishlists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later
Affected
up to 1.2.26
What to do
Affects up to 1.2.26. Update Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2025Better WishList API: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24641 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API better-wlm-api allows Stored XSS.This issue affects Better WishList API: from n/a through <= 1.1.3.
Product
Better WishList API
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Better WishList API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 30, 2025WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features): Insecure Direct Object ReferenceCVE-2024-13694 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.7 via the download_pdf_file() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to extract data from wishlists that they should not have access to.
Product
WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features)
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 29, 2025Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later: Stored Cross-Site ScriptingCVE-2024-13696 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later
Affected
up to 1.2.25
What to do
Affects up to 1.2.25. Update Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2025Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24657 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee Wishlist for WooCommerce wt-woocommerce-wishlist allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 2.1.2.
Product
Wishlist for WooCommerce
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 9, 2025NC Wishlist for Woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22505 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crispweb NC Wishlist for Woocommerce nc-wishlist-for-woocommerce allows SQL Injection.This issue affects NC Wishlist for Woocommerce: from n/a through <= 1.0.1.
Product
NC Wishlist for Woocommerce
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update NC Wishlist for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2024Wishlist for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56228 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce.This issue affects Wishlist for WooCommerce: from n/a through <= 3.1.2.
Product
Wishlist for WooCommerce
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 4, 2024TI WooCommerce Wishlist: Unauthorized modification of dataCVE-2024-10567 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates.
Product
TI WooCommerce Wishlist
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 23, 2024Wishlist for WooCommerce: Multi Wishlists Per Customer PRO: Reflected Cross-Site ScriptingCVE-2024-10519 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wtab' parameter in versions 3.0.8 to 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Note: Only WordPress installations with versions of PHP <=7.4 are affected by this vulnerability.
Product
Wishlist for WooCommerce: Multi Wishlists Per Customer PRO
Affected
up to 7.4
What to do
Affects up to 7.4. Update Wishlist for WooCommerce: Multi Wishlists Per Customer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Nov 1, 2024WishList Member X: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37108 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishList Member X allows Path Traversal.This issue affects WishList Member X: from n/a through 3.26.6.
Product
WishList Member X
Affected
up to 3.26.6
What to do
Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024WishList Member X: Missing AuthorizationCVE-2024-37106 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WishList Products WishList Member X allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WishList Member X: from n/a through 3.26.6
Product
WishList Member X
Affected
up to 3.26.6
What to do
Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2024TI WooCommerce Wishlist: Is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL queryCVE-2024-9156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
TI WooCommerce Wishlist
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 29, 2024TI WooCommerce Wishlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43917 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.
Product
TI WooCommerce Wishlist
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Docket (WooCommerce Collections / Wishlist / Watchlist): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43132 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) allows SQL Injection.This issue affects Docket (WooCommerce Collections / Wishlist / Watchlist): from n/a before 1.7.0.
Product
Docket (WooCommerce Collections / Wishlist / Watchlist)
Fixed in
1.7.0
What to do
Update Docket (WooCommerce Collections / Wishlist / Watchlist) to 1.7.0 or newer.
Full record and what to do →NVD record patchstack.com
Aug 19, 2024An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's parameterCVE-2024-42658 · Other software · nepstech · reported by MITRECritical 9.8
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's parameter
Product
ntpl-xpon1gfevn_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com linkedin.com
Aug 19, 2024An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login pCVE-2024-42657 · Other software · nepstech · reported by MITREHigh 7.5
An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process
Product
ntpl-xpon1gfevn_firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com linkedin.com
Aug 13, 2024Docket (WooCommerce Collections / Wishlist / Watchlist): Incorrect AuthorizationCVE-2024-43131 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Incorrect Authorization vulnerability in WPWeb Docket (WooCommerce Collections / Wishlist / Watchlist) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Docket (WooCommerce Collections / Wishlist / Watchlist): from n/a before 1.7.0.
Product
Docket (WooCommerce Collections / Wishlist / Watchlist)
Fixed in
1.7.0
What to do
Update Docket (WooCommerce Collections / Wishlist / Watchlist) to 1.7.0 or newer.
Full record and what to do →NVD record patchstack.com
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37113 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2024WishList Member X: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37110 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 9, 2024WishList Member X: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37112 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 24, 2024WishList Member X: Missing AuthorizationCVE-2024-37111 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 24, 2024WishList Member X: Improper Control of Generation of Code ('Code Injection')CVE-2024-37109 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows Code Injection.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 24, 2024WishList Member X: Improper Privilege ManagementCVE-2024-37107 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in Membership Software WishList Member X allows Privilege Escalation.This issue affects WishList Member X: from n/a before 3.26.7.
Product
WishList Member X
Fixed in
3.26.7
What to do
Update WishList Member X to 3.26.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024MC Woocommerce Wishlist: Missing AuthorizationCVE-2024-34819 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.7.2.
Product
MC Woocommerce Wishlist
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update MC Woocommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024MC Woocommerce Wishlist: Missing AuthorizationCVE-2024-34813 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.7.8.
Product
MC Woocommerce Wishlist
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update MC Woocommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2024YITH WooCommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34385 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Wishlist yith-woocommerce-wishlist.This issue affects YITH WooCommerce Wishlist: from n/a through <= 3.32.0.
Product
YITH WooCommerce Wishlist
Affected
up to 3.32.0
What to do
Affects up to 3.32.0. Update YITH WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024WishSuite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29927 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasTheme WishSuite allows Stored XSS.This issue affects WishSuite: from n/a through 1.3.7.
Product
WishSuite
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update WishSuite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 10, 2024IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity.CVE-2024-21643 · Other software · AzureAD · reported by GitHubHigh 7.1
IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.
Product
azure-activedirectory-identitymodel-extensions-for-dotnet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions.CVE-2023-34386 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions.
Fixed in
4.7.2
What to do
Update the plugin to 4.7.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 28, 2023TM WooCommerce Compare & Wishlist: Stored Cross-Site ScriptingCVE-2023-5230 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TM WooCommerce Compare & Wishlist
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update TM WooCommerce Compare & Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <= 1.3.3 versions.CVE-2023-23731 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <= 1.3.3 versions.
Fixed in
1.3.4
What to do
Update the plugin to 1.3.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 6, 2023versions up to, and including, 1.21.11 and 1.21.4: The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options ChangeCVE-2020-36725 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.
Product
versions up to, and including, 1.21.11 and 1.21.4
Affected
up to 1.21.11
What to do
Affects up to 1.21.11. Update versions up to, and including, 1.21.11 and 1.21.4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com templateinvaders.com
Mar 27, 2023QuickSwish: Does not have CSRF checkCVE-2023-0499 · WordPress plugins & themes · reported by WPScanMedium 4.3
The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Product
QuickSwish
Fixed in
1.1.0
What to do
Update QuickSwish to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.