Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,598 results · page 25 of 32

Mar 19, 2024Barcode Scanner with Inventory & Order Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27998 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.
Product
Barcode Scanner with Inventory & Order Manager
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Advanced Access Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29124 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Stored XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.
Product
Advanced Access Manager
Affected
up to 6.9.20
What to do
Affects up to 6.9.20. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WooCommerce License Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29121 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firassaidi WooCommerce License Manager allows Reflected XSS.This issue affects WooCommerce License Manager: from n/a through 5.3.1.
Product
WooCommerce License Manager
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update WooCommerce License Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Download Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29114 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This issue affects Download Manager: from n/a through 3.2.84.
Product
Download Manager
Affected
up to 3.2.84
What to do
Affects up to 3.2.84. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WooCommerce Google Feed Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29112 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Marketing Robot WooCommerce Google Feed Manager allows Stored XSS.This issue affects WooCommerce Google Feed Manager: from n/a through 2.2.0.
Product
WooCommerce Google Feed Manager
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update WooCommerce Google Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Advanced Access Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29127 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager allows Reflected XSS.This issue affects Advanced Access Manager: from n/a through 6.9.20.
Product
Advanced Access Manager
Affected
up to 6.9.20
What to do
Affects up to 6.9.20. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 17, 2024WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27959 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpexpertsio WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management allows Reflected XSS.This issue affects WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management: from n/a through 4.2.9.
Product
WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management
Affected
up to 4.2.9
What to do
Affects up to 4.2.9. Update WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 17, 2024Frontend File Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-25903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in N-Media Frontend File Manager.This issue affects Frontend File Manager: from n/a through 22.7.
Product
Frontend File Manager
Affected
up to 22.7
What to do
Affects up to 22.7. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 16, 2024Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates: Sensitive Information ExposureCVE-2024-1857 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the wps_wgm_preview_email_template(). This makes it possible for unauthenticated attackers to read password protected and draft posts that may contain sensitive data.
Product
Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates
Affected
up to 2.6.6
What to do
Affects up to 2.6.6. Update Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance: Cross-Site Request ForgeryCVE-2024-1642 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bulk' function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance
Affected
up to 4.6.0.1
What to do
Affects up to 4.6.0.1. Update MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce: SQL InjectionCVE-2024-1203 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Affected
up to 7.0.7
What to do
Affects up to 7.0.7. Update Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Reflected Cross-Site ScriptingCVE-2024-0976 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the plugin parameter in all versions up to, and including, 3.1.41 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Affected
up to 3.1.41
What to do
Affects up to 3.1.41. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Events Manager: Stored Cross-Site ScriptingCVE-2024-0614 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.4.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Events Manager
Affected
up to 6.4.6.4
What to do
Affects up to 6.4.6.4. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Mar 13, 2024File Manager Pro: Reflected Cross-Site ScriptingCVE-2023-7015 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
File Manager Pro
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record filemanagerpro.io wordfence.com
Mar 13, 2024Download Manager Pro: Stored Cross-Site ScriptingCVE-2023-6954 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.2.85 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Manager Pro
Affected
up to 3.2.85
What to do
Affects up to 3.2.85. Update Download Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) CVE-2023-6825 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target parameter in the mk_file_folder_manager_action_callback_shortcode function. This makes it possible for attackers to read the contents of arbitrary files on the server, which can contain sensitive information and to upload files into directories other than the intended directory for file uploads. The free version requires Administrator access for this vulnerability to be exploitable. The Pro version allows a file manager to be embedded via a shortcode and also allows admins to grant file handling privileges to other user levels, which could lead to this vulnerability being exploited by lower-level users.
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 13, 2024Download Manager: Unauthorized file download of files addedCVE-2023-6785 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin (even when privately published).
Product
Download Manager
Affected
up to 3.2.84
What to do
Affects up to 3.2.84. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2024SportsPress – Sports Club & League Manager: Unauthorized modification of dataCVE-2024-1178 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to update the permalink structure for the clubs
Product
SportsPress – Sports Club & League Manager
Affected
up to 2.7.17
What to do
Affects up to 2.7.17. Update SportsPress – Sports Club & League Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024SP Project & Document Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-24868 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69.
Product
SP Project & Document Manager
Affected
up to 4.69
What to do
Affects up to 4.69. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce: Time-based SQL InjectionCVE-2024-0786 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ee_syncProductCategory function using the parameters conditionData, valueData, productArray, exclude and include in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Affected
up to 7.0.7
What to do
Affects up to 7.0.7. Update Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 12, 2024Smart Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0566 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
Smart Manager
Fixed in
8.28.0
What to do
Update Smart Manager to 8.28.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 12, 2024Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently –: Deserialization of Untrusted DataCVE-2024-24796 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin.This issue affects Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin: from n/a through 4.1.1.
Product
Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently –
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 9, 2024Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin: Unauthorized access of dataCVE-2024-1122 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data.
Product
Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin
Affected
up to 3.3.50
What to do
Affects up to 3.3.50. Update Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 8, 2024BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24834 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net allows Stored XSS.This issue affects BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net: from n/a through 1.1.4.
Product
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024WP Club Manager – WordPress Sports Club: Unauthorized modification of dataCVE-2024-1177 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to update the permalink structure for the clubs
Product
WP Club Manager – WordPress Sports Club
Affected
up to 2.2.10
What to do
Affects up to 2.2.10. Update WP Club Manager – WordPress Sports Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Affiliates Manager: Cross-Site Request ForgeryCVE-2024-0859 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the process_bulk_action function in ListAffiliatesTable.php. This makes it possible for unauthenticated attackers to delete affiliates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Affiliates Manager
Affected
up to 2.9.34
What to do
Affects up to 2.9.34. Update Affiliates Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Unauthorized access, modification or loss of dataCVE-2024-0791 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions in all versions up to, and including, 1.0.8.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create, delete or modify taxonomy terms.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Cross-Site Request ForgeryCVE-2024-0790 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8.1. This is due to missing or incorrect nonce validation on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions. This makes it possible for unauthenticated attackers to create, modify and delete taxonomy terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Furthermore, the functions wpbe_save_options, wpbe_bulk_delete_posts_count, wpbe_bulk_delete_posts, and wpbe_save_meta are vulnerable to Cross-Site Request Forgery allowing for plugin options update, post count deletion, post deletion and modification of post metadata via forged request.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8.1
What to do
Affects up to 1.0.8.1. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024File Manager: Sensitive Information ExposureCVE-2024-0761 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access.
Product
File Manager
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 5, 2024File Manager Pro: Arbitrary File UploadCVE-2023-6846 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the server. Version 8.3.5 introduces a capability check that prevents users lower than admin from executing this function.
Product
File Manager Pro
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update File Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordfence.com
Feb 5, 2024PT Sign Ups – Beautiful volunteer sign ups and management made easy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24848 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups – Beautiful volunteer sign ups and management made easy: from n/a through 1.0.4.
Product
PT Sign Ups – Beautiful volunteer sign ups and management made easy
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update PT Sign Ups – Beautiful volunteer sign ups and management made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WOLF – WordPress Posts Bulk Editor and Manager Professional: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22159 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional allows Reflected XSS.This issue affects WOLF – WordPress Posts Bulk Editor and Manager Professional: from n/a through 1.0.8.
Product
WOLF – WordPress Posts Bulk Editor and Manager Professional
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update WOLF – WordPress Posts Bulk Editor and Manager Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Image Tag Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22160 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bradley B. Dalina Image Tag Manager allows Reflected XSS.This issue affects Image Tag Manager: from n/a through 1.5.
Product
Image Tag Manager
Affected
up to 1.5
What to do
Affects up to 1.5. Update Image Tag Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Frontpage Manager: Cross-Site Request Forgery (CSRF)CVE-2024-22285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Elise Bosse Frontpage Manager.This issue affects Frontpage Manager: from n/a through 1.3.
Product
Frontpage Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update Frontpage Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 24, 2024Barcode Scanner and Inventory manager: Unrestricted Upload of File with Dangerous TypeCVE-2023-52221 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in UkrSolution Barcode Scanner and Inventory manager.This issue affects Barcode Scanner and Inventory manager: from n/a through 1.5.1.
Product
Barcode Scanner and Inventory manager
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Barcode Scanner and Inventory manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Traffic Manager: Missing AuthorizationCVE-2022-41695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5.
Product
Traffic Manager
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Traffic Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 16, 20243dprint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-3899 · WordPress plugins & themes · reported by WPScanHigh 8.1
The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged in admin into submitting a form.
Product
3dprint
Fixed in
3.5.6.9
What to do
Update 3dprint to 3.5.6.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024School Management: Contains an obfuscated backdoor injected in it's license checking code that registers a REST API handlerCVE-2022-1609 · WordPress plugins & themes · reported by WPScanCritical 9.8
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
Product
School Management
Fixed in
9.9.7
What to do
Update School Management to 9.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg: Does not properly secure some of its AJAX actionsCVE-2023-6843 · WordPress plugins & themes · reported by WPScanMedium 4.3
The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 does not properly secure some of its AJAX actions, allowing any logged-in users to modify its settings.
Product
easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg
Fixed in
2.4.7
What to do
Update easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg to 2.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 11, 2024Manage Notification E-mails: Missing AuthorizationCVE-2023-6496 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings.
Product
Manage Notification E-mails
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Manage Notification E-mails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2024Debug Log Manager: Contains a Directory listing vulnerability was discoveredCVE-2023-6383 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data
Product
Debug Log Manager
Fixed in
2.3.0
What to do
Update Debug Log Manager to 2.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52215 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UkrSolution Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce.This issue affects Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce: from n/a through 1.5.1.
Product
Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024Affiliates Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52148 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.30.
Product
Affiliates Manager
Affected
up to 2.9.30
What to do
Affects up to 2.9.30. Update Affiliates Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024Affiliates Manager: Cross-Site Request Forgery (CSRF)CVE-2023-52130 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31.
Product
Affiliates Manager
Affected
up to 2.9.31
What to do
Affects up to 2.9.31. Update Affiliates Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 1, 2024Download Manager: Does not protect file download's passwordsCVE-2023-6421 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.
Product
Download Manager
Fixed in
3.2.83
What to do
Update Download Manager to 3.2.83 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51675 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Job Manager & Career – Manage job board listings, and recruitments: Cross-Site Request Forgery (CSRF), Deserialization of Untrusted DataCVE-2023-51545 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.
Product
Job Manager & Career – Manage job board listings, and recruitments
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Job Manager & Career – Manage job board listings, and recruitments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.15
What to do
Affects up to 6.9.15. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Zephyr Project Manager: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-31237 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.9.
Product
Zephyr Project Manager
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.