Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

434new WordPress flaws this week

394,398entries in the database

17,710 results · page 202 of 355

Dec 21, 2024Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows): Unauthorized access of dataCVE-2024-11852 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layout templates.
Product
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)
Affected
up to 5.10.12
What to do
Affects up to 5.10.12. Update Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2024WP BASE Booking of Appointments, Services and Events: Unauthorized access of dataCVE-2024-12558 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive information from the database, such as the hashed administrator password.
Product
WP BASE Booking of Appointments, Services and Events
Affected
up to 4.9.2
What to do
Affects up to 4.9.2. Update WP BASE Booking of Appointments, Services and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2024The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has notCVE-2023-31279 · Other software · Sierra Wireless · reported by security@sierrawireless.comHigh 8.1
The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has not disabled the AirVantage Management Service on the devices or registered the device. This could enable an attacker to configure, manage, and execute AT commands on an unsuspecting user’s devices.
Product
AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.sierrawireless.com
Dec 20, 2024Server-Side Request Forgery in URL Mapper in Arctic Security's Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to exfiltrate andCVE-2024-12867 · Other software · Arctic Security · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166High 8.8
Server-Side Request Forgery in URL Mapper in Arctic Security's Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to exfiltrate and modify configurations and data.
Product
Arctic Hub
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arcticsecurity.com
Dec 20, 2024In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projectsCVE-2024-56350 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com
Dec 20, 2024In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logsCVE-2024-56349 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com
Dec 20, 2024In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agentsCVE-2024-56348 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com
Dec 20, 2024Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arCVE-2024-12014 · Other software · Lleidanet PKI · reported by cve-coordination@incibe.esLow 2
Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.
Product
eSigna
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record edgewatch.com
Dec 20, 2024There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that CVE-2024-7726 · Other software · Kioxia · reported by cve-coordination@google.comMedium 5.7
There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that is exposed on the drive’s circuit board. Due to the wide cutout of the enclosures, the JTAG port can be accessed without having to open the disk enclosure. Utilizing the JTAG debug port, an attacker with (temporary) physical access can get full access to the firmware and memory on the 2 main CPU cores within the drive including the execution of arbitrary code, the modification of firmware execution flow and data or bypassing the firmware signature verification during boot-up.
Product
CM6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Dec 20, 2024Maintenance & Coming Soon Redirect Animation: Unauthorized modification of dataCVE-2024-9503 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wploti_add_whitelisted_roles_option', 'wploti_remove_whitelisted_roles_option', 'wploti_add_whitelisted_users_option', 'wploti_remove_whitelisted_users_option', and 'wploti_uploaded_animation_save_option' functions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify certain plugin settings.
Product
Maintenance & Coming Soon Redirect Animation
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Maintenance & Coming Soon Redirect Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2024File Manager Pro – Filester: Unauthorized modification of dataCVE-2024-12331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_plugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Filebird plugin.
Product
File Manager Pro – Filester
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 19, 2024Download Manager: Unauthorized download of password-protected contentCVE-2024-11768 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files.
Product
Download Manager
Affected
up to 3.3.03
What to do
Affects up to 3.3.03. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2024A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via CVE-2023-34990 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests.
Product
FortiWLM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com
Dec 18, 2024Travel Booking: Unauthorized modification of dataCVE-2024-11926 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '__stPartnerCreateServiceRental', 'st_delete_order_item', '_st_partner_approve_booking', 'save_order_item', and '__userDenyEachInfo' functions in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify posts, delete posts and pages, approve arbitrary orders, insert orders with arbitrary prices, and deny user information.
Product
Travel Booking
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Travel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record travelerwp.com wordfence.com
Dec 18, 2024An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streamsCVE-2024-12698 · Other software · Red Hat · reported by Red HatMedium 6.5
An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were protected, not streams created by authenticated sources.
Product
Red Hat OpenShift Container Platform 4.18
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Dec 16, 2024WP-NERD Toolkit: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-54279 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tobias Keller WP-NERD Toolkit wp-nerd-toolkit.This issue affects WP-NERD Toolkit: from n/a through <= 1.1.
Product
WP-NERD Toolkit
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP-NERD Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 14, 2024IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a CVE-2024-31892 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a csv file due to improper neutralization of formula elements.
Product
Storage Scale
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized accessCVE-2024-11715 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an employer.
Product
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 14, 2024WP Job Portal – A Complete Recruitment System for Company or Job Board website: Unauthorized access of dataCVE-2024-11712 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getResumeFileDownloadById() function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to download other users resumes.
Product
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update WP Job Portal – A Complete Recruitment System for Company or Job Board website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com gist.github.com
Dec 13, 2024Cleo Multiple Products Unauthenticated File Upload VulnerabilityCVE-2024-55956 · Other software · Cleo · reported by MITREExploitedRansomwareCritical 9.8
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Product
Multiple Products
On CISA’s list since
Dec 17, 2024 (federal fix deadline Jan 7, 2025)
What to do
Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.cleo.com support.cleo.com
Dec 13, 2024Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs.CVE-2024-11986 · Other software · CrushFTP, LLC · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.6
Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.
Product
CrushFTP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record crushftp.com
Dec 13, 2024WP Crowdfunding: Unauthorized plugin installationCVE-2024-11911 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement.
Product
WP Crowdfunding
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update WP Crowdfunding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2024WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling: Unauthorized loss of dataCVE-2024-11275 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.
Product
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024AR for: Unauthorized double extension file uploadCVE-2024-12300 · WordPress plugins & themes · reported by WordfenceLow 3.7
The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It's important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.
Product
AR for
Affected
up to 7.3
What to do
Affects up to 7.3. Update AR for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.CVE-2024-49147 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.
Product
Microsoft Update Catalog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 12, 2024An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters.CVE-2024-28145 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.9
An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter "field" with the UNION keyword.
Product
Scan2Net
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com imageaccess.de
Dec 12, 2024Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3.CVE-2024-12564 · Other software · Open Design Alliance · reported by 8a9629cb-c5e7-4d2a-a894-111e8039b7eaMedium 6.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things about the target application which may help in further investigation and exploitation.
Product
CDE inWEB SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record opendesign.com
Dec 12, 2024Essential Real Estate: Unauthorized access of dataCVE-2024-12329 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to access invoices and transaction logs
Product
Essential Real Estate
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Hash Form – Drag & Drop Form Builder: Unauthorized accessCVE-2024-12201 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles.
Product
Hash Form – Drag & Drop Form Builder
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Hash Form – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy): Unauthorized modification of dataCVE-2024-11724 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpl_script_save AJAX action in all versions up to, and including, 3.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to whitelist scripts.
Product
Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy)
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Web3 Crypto Payments by DePay for WooCommerce: Unauthorized access of dataCVE-2024-12265 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/depay/wc/debug REST API endpoint in all versions up to, and including, 2.12.17. This makes it possible for unauthenticated attackers to retrieve debug infromation.
Product
Web3 Crypto Payments by DePay for WooCommerce
Affected
up to 2.12.17
What to do
Affects up to 2.12.17. Update Web3 Crypto Payments by DePay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Child Theme Creator by Orbisius: Unauthorized modification of dataCVE-2024-12263 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cloud_delete() and cloud_update() functions in all versions up to, and including, 1.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete cloud snippets. Please note that this vulnerability was present in the Cloud Library Addon used by the plugin and not in the plugin itself, the cloud library has been removed entirely.
Product
Child Theme Creator by Orbisius
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Child Theme Creator by Orbisius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses: Unauthorized accessCVE-2024-12172 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.
Product
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Affected
up to 3.2.21
What to do
Affects up to 3.2.21. Update WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2024Snippet Shortcodes: Unauthorized Shortcode DeletionCVE-2024-12018 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Shortcodes.
Product
Snippet Shortcodes
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update Snippet Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 12, 2024Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Unauthorized arbitrary plugin installation and activationCVE-2024-10124 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1.
Product
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2024AI Post Generator | AutoWriter: Unauthorized modification of dataCVE-2024-11709 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ai_post_generator_delete_Post AJAX action in all versions up to, and including, 3.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary pages and posts.
Product
AI Post Generator | AutoWriter
Affected
up to 3.5
What to do
Affects up to 3.5. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024Custom Skins Contact Form 7: Unauthorized modification of dataCVE-2024-12341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Skins Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf7cs_action_callback' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the content of any post and create new skins.
Product
Custom Skins Contact Form 7
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Skins Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2024de:branding: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11443 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The de:branding plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the debranding_save() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
de:branding
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update de:branding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2024Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.CVE-2024-49128 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
Product
Windows Server 2012
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Dec 11, 2024An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service.CVE-2024-37401 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service.
Product
Connect Secure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com
Dec 11, 2024A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.CVE-2024-37377 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.
Product
Connect Secure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com
Dec 11, 2024RapidLoad – Optimize Web Vitals Automatically: Unauthorized access of data and modification of dataCVE-2024-11840 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.
Product
RapidLoad – Optimize Web Vitals Automatically
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update RapidLoad – Optimize Web Vitals Automatically to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 10, 2024An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative accessCVE-2024-11639 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Critical 10
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access
Product
Cloud Services Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com
Dec 10, 2024An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the wwwCVE-2024-28138 · Other software · Image Access GmbH · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 7.3
An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized.
Product
Scan2Net
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record r.sec-consult.com imageaccess.de
Dec 10, 2024WPForms: Unauthorized modification of dataCVE-2024-11205 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.
Product
WPForms
Affected
up to 1.9.2.1
What to do
Affects up to 1.9.2.1. Update WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2024Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack.CVE-2024-47582 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application.
Product
SAP NetWeaver AS JAVA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com url.sap
Dec 9, 2024A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive informatioCVE-2024-46547 · Other software · reported by MITREHigh 7.5
A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive information due to improper access control validation via PHP Info Page. This issue can lead to data leaks.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Dec 9, 2024RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.CVE-2024-53450 · Other software · Infiniflow · reported by MITREHigh 7.5
RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.
Product
Ragflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 9, 2024Analytify: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2024-53814 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a through <= 5.4.3.
Product
Analytify
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2024Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of stCVE-2024-12306 · Other software · Unifiedtransform · reported by vulnerability@ncsc.chMedium 4.3
Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level access control issues in profile viewing endpoints. A malicious student user can access personal information of other students and teachers through these vulnerabilities. At the time of publication of the CVE no patch is available.
Product
Unifiedtransform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.