Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,200 results · page 22 of 44
Oct 29, 2024WP Abstracts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50411 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.7.1.
- Product
- WP Abstracts
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Contact Form 7 + Telegram: Unauthorized modification of data and loss of dataCVE-2024-9629 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wpcf7_Telegram::ajax' function in versions up to, and including, 0.8.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve, pause and refuse subscriptions.
- Product
- Contact Form 7 + Telegram
- Affected
- up to 0.8.5
- What to do
- Affects up to 0.8.5. Update Contact Form 7 + Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2024Interactive World Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50462 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in html5maps Interactive World Map interactive-world-map allows Stored XSS.This issue affects Interactive World Map: from n/a through <= 3.4.4.
- Product
- Interactive World Map
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Interactive World Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Unauthorized accessCVE-2024-10402 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to create new or edit existing forms, including updating the default registration role to Administrator on User Registration forms.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.35.1
- What to do
- Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 24, 2024Contact Form 7 – Repeatable Fields: Stored Cross-Site ScriptingCVE-2024-10180 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's field_group shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form 7 – Repeatable Fields
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Contact Form 7 – Repeatable Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 24, 2024Compact WP Audio Player: Stored Cross-Site ScriptingCVE-2024-10176 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Compact WP Audio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_embed_player shortcode in all versions up to, and including, 1.9.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Compact WP Audio Player
- Affected
- up to 1.9.13
- What to do
- Affects up to 1.9.13. Update Compact WP Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 20, 2024SW Contact Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49612 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanjeev SW Contact Form sw-contact-form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through <= 1.0.
- Product
- SW Contact Form
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update SW Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Crazy Call To Action Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49236 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-action-box allows DOM-Based XSS.This issue affects Crazy Call To Action Box: from n/a through <= 1.0.5.
- Product
- Crazy Call To Action Box
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Crazy Call To Action Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Da Reactions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49255 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele Alessandra Da Reactions da-reactions allows Stored XSS.This issue affects Da Reactions: from n/a through <= 5.1.5.
- Product
- Da Reactions
- Affected
- up to 5.1.5
- What to do
- Affects up to 5.1.5. Update Da Reactions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Awesome Contact Form7 for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49319 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B.M. Rafiul Alam Awesome Contact Form7 for Elementor awesome-contact-form7-for-elementor.This issue affects Awesome Contact Form7 for Elementor: from n/a through <= 3.0.
- Product
- Awesome Contact Form7 for Elementor
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Awesome Contact Form7 for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024WP SendFox: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-49284 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BogdanFix WP SendFox wp-sendfox allows Retrieve Embedded Sensitive Data.This issue affects WP SendFox: from n/a through <= 1.3.1.
- Product
- WP SendFox
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update WP SendFox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Contact Forms, Live Support, CRM, Video Messages: Insertion of Sensitive Information Into Sent DataCVE-2024-49235 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Retrieve Embedded Sensitive Data.This issue affects Contact Forms, Live Support, CRM, Video Messages: from n/a through <= 1.10.2.
- Product
- Contact Forms, Live Support, CRM, Video Messages
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update Contact Forms, Live Support, CRM, Video Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Contact Form by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48046 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Stored XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.7.28
- What to do
- Affects up to 1.7.28. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Contact Form Widget: Cross-Site Request Forgery (CSRF)CVE-2024-48037 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.4.2.
- Product
- Contact Form Widget
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Contact Form Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Contact Form 7 – PayPal & Stripe Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48021 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through <= 2.3.
- Product
- Contact Form 7 – PayPal & Stripe Add-on
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Contact Form 7 – PayPal & Stripe Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9352 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possible for unauthenticated attackers to create draft forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.35.1
- What to do
- Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9351 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for unauthenticated attackers to create draft quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.35.1
- What to do
- Affects up to 1.35.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2024Contact Form by Supsystic: Deserialization of Untrusted DataCVE-2024-48042 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.7.28
- What to do
- Affects up to 1.7.28. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2024Multiline files upload for contact form 7: Unauthorized plugin deactivationCVE-2024-9891 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the mfcf7_zl_custom_handle_deactivation_plugin_form_submission() function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin and send a custom reason from the site.
- Product
- Multiline files upload for contact form 7
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Multiline files upload for contact form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2024WP 2FA with Telegram: Two-Factor Authentication BypassCVE-2024-9820 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.
- Product
- WP 2FA with Telegram
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WP 2FA with Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 11, 2024Multi Step for Contact Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47331 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ninja Team Multi Step for Contact Form cf7-multi-step allows SQL Injection.This issue affects Multi Step for Contact Form: from n/a through <= 2.7.7.
- Product
- Multi Step for Contact Form
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update Multi Step for Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024Hunk Companion: Unauthorized plugin installation/activationCVE-2024-9707 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
- Product
- Hunk Companion
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Hunk Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 11, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Arbitrary file readCVE-2024-9507 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.15.2 due to improper input validation within the iconUpload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to leverage a PHP filter chain attack and read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
- Affected
- up to 2.15.2
- What to do
- Affects up to 2.15.2. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 7, 2024uListing: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-47344 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Stylemix uListing ulisting.This issue affects uListing: from n/a through <= 2.1.5.
- Product
- uListing
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2024WP Abstracts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44045 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.6.5.
- Product
- WP Abstracts
- Affected
- up to 2.6.5
- What to do
- Affects up to 2.6.5. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Stored Cross-Site ScriptingCVE-2024-9528 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2024Loggedin – Limit Active Logins: Reflected Cross-Site ScriptingCVE-2024-9228 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Loggedin – Limit Active Logins plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable when the leave a review notice is present.
- Product
- Loggedin – Limit Active Logins
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Loggedin – Limit Active Logins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Stored Cross-Site ScriptingCVE-2024-8633 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- Affected
- up to 1.15.27
- What to do
- Affects up to 1.15.27. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 26, 2024Contact Form 7 Math Captcha: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6517 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users.
- Product
- Contact Form 7 Math Captcha
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Contact Form 7 Math Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2024WordPress Tag Cloud Plugin – Tag Groups: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43237 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-groups.This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through <= 2.0.3.
- Product
- WordPress Tag Cloud Plugin – Tag Groups
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update WordPress Tag Cloud Plugin – Tag Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2024Ninja Forms Contact Form: Reflected Self-Based Cross-Site ScriptingCVE-2024-3866 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation of this vulnerability requires "maintenance mode" for a targeted form to be enabled. However, there is no setting available to the attacker or even an administrator-level user to enable this mode. The mode is only enabled during a required update, which is a very short window of time. Additionally, because of the self-based nature of this vulnerability, attackers would have to rely on additional techniques to execute a supplied payload in the context of targeted user.
- Product
- Ninja Forms Contact Form
- Affected
- up to 3.8.15
- What to do
- Affects up to 3.8.15. Update Ninja Forms Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 24, 2024Contact Form to Any API: Stored Cross-Site ScriptingCVE-2024-7617 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Contact Form to Any API
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Contact Form to Any API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 20, 2024Webo-facto: Privilege escalationCVE-2024-8853 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Webo-facto plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.40 due to insufficient restriction on the 'doSsoAuthentification' function. This makes it possible for unauthenticated attackers to make themselves administrators by registering with a username that contains '-wfuser'.
- Product
- Webo-facto
- Affected
- up to 1.40
- What to do
- Affects up to 1.40. Update Webo-facto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 13, 2024WPFactory Helper: Reflected Cross-Site ScriptingCVE-2024-8656 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WPFactory Helper
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update WPFactory Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2024Floating Contact Button: Does not sanitise and escape some of its settingsCVE-2024-7891 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Floating Contact Button
- Fixed in
- 2.8
- What to do
- Update Floating Contact Button to 2.8 or newer.
Sep 8, 2024Opti Marketing: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6928 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Opti Marketing
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Opti Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024TrueBooker: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6924 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- TrueBooker
- Fixed in
- 1.0.3
- What to do
- Update TrueBooker to 1.0.3 or newer.
Sep 4, 2024Viral Signup: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6926 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Viral Signup
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Viral Signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 1, 2024Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder: Unauthorized Malichimp API key updateCVE-2024-5053 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.
- Product
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
- Affected
- up to 5.1.18
- What to do
- Affects up to 5.1.18. Update Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2024Tutor LMS Pro: Unauthorized administrative actions executionCVE-2024-5784 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and tutor_gc_class_action in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with the subscriber-level access and above, to preform an administrative actions on the site, like comments, posts or users deletion, viewing notifications, etc.
- Product
- Tutor LMS Pro
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtutorlms.comwordfence.com
Aug 29, 2024GHActivity: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43949 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic GHActivity allows Stored XSS.This issue affects GHActivity: from n/a through 2.0.0-alpha.
- Product
- GHActivity
- Affected
- up to 2.0.0-alpha
- What to do
- Affects up to 2.0.0-alpha. Update GHActivity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: Unauthorized loss of dataCVE-2024-5857 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the af2_handel_file_remove AJAX action in all versions up to, and including, 3.7.3.2. This makes it possible for unauthenticated attackers to delete arbitrary media files.
- Product
- Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
- Affected
- up to 3.7.3.2
- What to do
- Affects up to 3.7.3.2. Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 28, 2024Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: Unauthorized modification of dataCVE-2024-7447 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_af2_handel_file_upload' function in all versions up to, and including, 3.7.3.2. This makes it possible for unauthenticated attackers to upload arbitrary media to the site, even if no forms exist.
- Product
- Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
- Affected
- up to 3.7.3.2
- What to do
- Affects up to 3.7.3.2. Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2024Store Locator Plus: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17.01.
- Product
- Store Locator Plus
- Affected
- up to 2311.17.01
- What to do
- Affects up to 2311.17.01. Update Store Locator Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Leopard - WordPress offload media: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.
- Product
- Leopard - WordPress offload media
- Affected
- up to 2.0.36
- What to do
- Affects up to 2.0.36. Update Leopard - WordPress offload media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Bit Form Pro: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43251 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4.
- Product
- Bit Form Pro
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Bit Form Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024Flash & HTML5 Video: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43319 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31.
- Product
- Flash & HTML5 Video
- Affected
- up to 2.5.31
- What to do
- Affects up to 2.5.31. Update Flash & HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2024wpForo Forum: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43289 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.
- Product
- wpForo Forum
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2024Flamix: Bitrix24 and Contact Form 7 integrations: Full Path DisclosureCVE-2024-6568 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Flamix: Bitrix24 and Contact Form 7 integrations
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Flamix: Bitrix24 and Contact Form 7 integrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 20, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Arbitrary file deletionCVE-2024-7782 · WordPress plugins & themes · reported by WordfenceHigh 8.7
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the iconRemove function in versions 2.0 to 2.13.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
- Affected
- 2.0 to 2.13.4
- What to do
- Affects 2.0 to 2.13.4. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.