Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

11,336 results · page 202 of 227

Dec 28, 2023Squirrly SEO - Advanced Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50854 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Squirrly Squirrly SEO - Advanced Pack.This issue affects Squirrly SEO - Advanced Pack: from n/a before 2.4.02.
Product
Squirrly SEO - Advanced Pack
Fixed in
2.4.02
What to do
Update Squirrly SEO - Advanced Pack to 2.4.02 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50853 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms.This issue affects Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: from n/a through 1.75.0.
Product
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms
Affected
up to 1.75.0
What to do
Affects up to 1.75.0. Update Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Booking Calendar | Appointment Booking | BookIt: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50852 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.
Product
Booking Calendar | Appointment Booking | BookIt
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update Booking Calendar | Appointment Booking | BookIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Appointment Booking Calendar — Simply Schedule Appointments Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50851 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin.This issue affects Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: from n/a before 1.6.6.1.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Fixed in
1.6.6.1
What to do
Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.6.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023E2Pdf – Export To Pdf Tool for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50849 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.23.
Product
E2Pdf – Export To Pdf Tool for
Affected
up to 1.20.23
What to do
Affects up to 1.20.23. Update E2Pdf – Export To Pdf Tool for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023404 Solution: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50848 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.34.0.
Product
404 Solution
Affected
up to 2.34.0
What to do
Affects up to 2.34.0. Update 404 Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Booking for Appointments and Events Calendar – Amelia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50860 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS.This issue affects Booking for Appointments and Events Calendar – Amelia: from n/a through 1.0.85.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 1.0.85
What to do
Affects up to 1.0.85. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023WP Crowdfunding: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50859 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6.
Product
WP Crowdfunding
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50857 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.
Product
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – CustCVE-2023-50856 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits.This issue affects Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits: from n/a through 2.14.3.
Affected
up to 2.14.3
What to do
Affects up to 2.14.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023HTML Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50836 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a through 1.3.28.
Product
HTML Forms
Affected
up to 1.3.28
What to do
Affects up to 1.3.28. Update HTML Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Product Add-Ons: Deserialization of Untrusted DataCVE-2023-32795 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.
Product
Product Add-Ons
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Uncode - Creative & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51501 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Uncode - Creative & WooCommerce WordPress Theme: from n/a through 2.8.6.
Product
Uncode - Creative & WooCommerce
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Uncode - Creative & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023WordPress Infinite Scroll – Ajax Load More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50874 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1.
Product
WordPress Infinite Scroll – Ajax Load More
Affected
up to 6.1.0.1
What to do
Affects up to 6.1.0.1. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 26, 2023The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tagCVE-2023-6250 · WordPress plugins & themes · reported by WPScanHigh 7.5
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag
Product
BestWebSoft's Like & Share
Fixed in
2.74
What to do
Update BestWebSoft's Like & Share to 2.74 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro: Does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version)CVE-2023-6114 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.
Product
Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro
Fixed in
1.5.7.1
What to do
Update Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro to 1.5.7.1 or newer.
Full record and what to do →NVD record drive.google.com wpscan.com
Dec 26, 2023Hotel Booking Lite: Does not validate file paths provided via user inputCVE-2023-5991 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
Product
Hotel Booking Lite
Fixed in
4.8.5
What to do
Update Hotel Booking Lite to 4.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5674 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Mail Log: Does not properly validate file extensions uploading files to attach to emailsCVE-2023-5673 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Mail Log: Does not properly validate file path parametersCVE-2023-5672 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5645 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic.CVE-2015-10127 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.
Product
PlusCaptcha
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update PlusCaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Dec 21, 2023WooCommerce Menu Extension: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50834 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech WooCommerce Menu Extension allows Stored XSS.This issue affects WooCommerce Menu Extension: from n/a through 1.6.2.
Product
WooCommerce Menu Extension
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update WooCommerce Menu Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Authorization Bypass Through User-Controlled KeyCVE-2023-47191 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: from n/a through 1.2.2.
Product
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Colibri Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50833 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239.
Product
Colibri Page Builder
Affected
up to 1.0.239
What to do
Affects up to 1.0.239. Update Colibri Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Multi Step Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50832 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mondula GmbH Multi Step Form allows Stored XSS.This issue affects Multi Step Form: from n/a through 1.7.13.
Product
Multi Step Form
Affected
up to 1.7.13
What to do
Affects up to 1.7.13. Update Multi Step Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023CURCY – Multi Currency for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50831 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY – Multi Currency for WooCommerce allows Stored XSS.This issue affects CURCY – Multi Currency for WooCommerce: from n/a through 2.2.0.
Product
CURCY – Multi Currency for WooCommerce
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update CURCY – Multi Currency for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Seos Contact Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50830 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seosbg Seos Contact Form allows Stored XSS.This issue affects Seos Contact Form: from n/a through 1.8.0.
Product
Seos Contact Form
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Seos Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Loan Repayment Calculator and Application Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50829 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aerin Loan Repayment Calculator and Application Form allows Stored XSS.This issue affects Loan Repayment Calculator and Application Form: from n/a through 2.9.3.
Product
Loan Repayment Calculator and Application Form
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Loan Repayment Calculator and Application Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Ultimate Dashboard – Custom WordPress Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50828 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ultimate Dashboard – Custom WordPress Dashboard allows Stored XSS.This issue affects Ultimate Dashboard – Custom WordPress Dashboard: from n/a through 3.7.11.
Product
Ultimate Dashboard – Custom WordPress Dashboard
Affected
up to 3.7.11
What to do
Affects up to 3.7.11. Update Ultimate Dashboard – Custom WordPress Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Accredible Certificates & Open Badges: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50827 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Accredible Accredible Certificates & Open Badges allows Stored XSS.This issue affects Accredible Certificates & Open Badges: from n/a through 1.4.8.
Product
Accredible Certificates & Open Badges
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Accredible Certificates & Open Badges to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Menu Image, Icons made easy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50826 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Freshlight Lab Menu Image, Icons made easy allows Stored XSS.This issue affects Menu Image, Icons made easy: from n/a through 3.10.
Product
Menu Image, Icons made easy
Affected
up to 3.10
What to do
Affects up to 3.10. Update Menu Image, Icons made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023iframe Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50825 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terrier Tenacity iframe Shortcode allows Stored XSS.This issue affects iframe Shortcode: from n/a through 2.0.
Product
iframe Shortcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update iframe Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Insert or Embed Articulate Content into: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50824 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Batt Insert or Embed Articulate Content into WordPress allows Stored XSS.This issue affects Insert or Embed Articulate Content into WordPress: from n/a through 4.3000000021.
Product
Insert or Embed Articulate Content into
Affected
up to 4.3000000021
What to do
Affects up to 4.3000000021. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023CSS & JavaScript Toolbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50823 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wipeout Media CSS & JavaScript Toolbox allows Stored XSS.This issue affects CSS & JavaScript Toolbox: from n/a through 11.7.
Product
CSS & JavaScript Toolbox
Affected
up to 11.7
What to do
Affects up to 11.7. Update CSS & JavaScript Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Currency Converter Widget – Exchange Rates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50822 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Currency.Wiki Currency Converter Widget – Exchange Rates allows Stored XSS.This issue affects Currency Converter Widget – Exchange Rates: from n/a through 3.0.2.
Product
Currency Converter Widget – Exchange Rates
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Currency Converter Widget – Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Simple Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50377 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AB-WP Simple Counter allows Stored XSS.This issue affects Simple Counter: from n/a through 1.0.2.
Product
Simple Counter
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Simple Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WP Edit Username: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47527 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sajjad Hossain Sagor WP Edit Username allows Stored XSS.This issue affects WP Edit Username: from n/a through 1.0.5.
Product
WP Edit Username
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP Edit Username to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Event Monster – Event Management, Tickets Booking, Upcoming Event: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47525 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through 1.3.2.
Product
Event Monster – Event Management, Tickets Booking, Upcoming Event
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Export All Posts, Products, Orders, Refunds & Users: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-2487 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Smackcoders Export All Posts, Products, Orders, Refunds & Users.This issue affects Export All Posts, Products, Orders, Refunds & Users: from n/a through 2.4.1.
Product
Export All Posts, Products, Orders, Refunds & Users
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export All Posts, Products, Orders, Refunds & Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Adifier - Classified Ads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49752 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads WordPress Theme.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
Product
Adifier - Classified Ads
Fixed in
3.1.4
What to do
Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023MSync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49166 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0.
Product
MSync
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update MSync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Bravo Translate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49161 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Guelben Bravo Translate.This issue affects Bravo Translate: from n/a through 1.2.
Product
Bravo Translate
Affected
up to 1.2
What to do
Affects up to 1.2. Update Bravo Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Houzez - Real Estate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-29432 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.
Product
Houzez - Real Estate
Fixed in
2.8.3
What to do
Update Houzez - Real Estate to 2.8.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Contact Form to DB by BestWebSoft – Messages Database Plugin For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-29096 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.0.
Product
Contact Form to DB by BestWebSoft – Messages Database Plugin For
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Advanced Page Visit Counter – Most Wanted Analytics Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28788 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a through 6.4.2.
Product
Advanced Page Visit Counter – Most Wanted Analytics Plugin for
Affected
up to 6.4.2
What to do
Affects up to 6.4.2. Update Advanced Page Visit Counter – Most Wanted Analytics Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Slideshow Gallery LITE: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28491 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6.
Product
Slideshow Gallery LITE
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Slideshow Gallery LITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-26525 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.12.
Product
Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Affected
up to 3.7.12
What to do
Affects up to 3.7.12. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023BSK Forms Blacklist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30872 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Forms Blacklist: from n/a through 3.6.2.
Product
BSK Forms Blacklist
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023CM Popup Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-30750 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This issue affects CM Popup Plugin for WordPress: from n/a through 1.5.10.
Product
CM Popup Plugin for
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update CM Popup Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.