Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,981 results · page 27 of 60

Nov 27, 2023WordPress Backup & Migration: Does not authorize some AJAX requestsCVE-2023-5737 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.
Product
WordPress Backup & Migration
Fixed in
1.4.4
What to do
Update WordPress Backup & Migration to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WassUp Real Time Analytics: Does not escape IP address provided via some headers before outputting them back in an admin pageCVE-2023-5653 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins
Product
WassUp Real Time Analytics
Affected
up to 1.9.4.5
What to do
Affects up to 1.9.4.5. Update WassUp Real Time Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Martins Free & Easy SEO BackLink Link Building Network: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Martins Free & Easy SEO BackLink Link Building Network
Fixed in
1.2.30
What to do
Update Martins Free & Easy SEO BackLink Link Building Network to 1.2.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Mmm Simple File List: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4514 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Mmm Simple File List
Affected
up to 2.3
What to do
Affects up to 2.3. Update Mmm Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2023The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WCVE-2023-5815 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes it possible for unauthenticated attackers to include arbitrary PHP files and achieve remote code execution. On vulnerable Docker configurations it may be possible for an attacker to create a PHP file and then subsequently include it to achieve RCE.
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 22, 2023Garden Gnome Package: Stored Cross-Site ScriptingCVE-2023-5664 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ggpkg' shortcode in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 2.2.7 and fully patched in version 2.2.9.
Product
Garden Gnome Package
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Garden Gnome Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 20, 2023Seraphinite Accelerator: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5609 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Seraphinite Accelerator
Fixed in
2.2.29
What to do
Update Seraphinite Accelerator to 2.2.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023Bonus for Woo: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-5140 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Bonus for Woo
Fixed in
5.8.3
What to do
Update Bonus for Woo to 5.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change tCVE-2023-4824 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023Magic Embeds: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4799 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Magic Embeds
Fixed in
3.1.2
What to do
Update Magic Embeds to 3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Prashant Walke WP All Backup plugin <= 2.4.3 versions.CVE-2023-32583 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in Prashant Walke WP All Backup plugin <= 2.4.3 versions.
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023UpdraftPlus: WordPress Backup & Migration: Cross-Site Request ForgeryCVE-2023-5982 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information.
Product
UpdraftPlus: WordPress Backup & Migration
Affected
up to 1.23.10
What to do
Affects up to 1.23.10. Update UpdraftPlus: WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2023Emails & Newsletters with Jackmail: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46821 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.
Product
Emails & Newsletters with Jackmail
Affected
up to 1.2.22
What to do
Affects up to 1.2.22. Update Emails & Newsletters with Jackmail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Awesome Support: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5354 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Awesome Support
Fixed in
6.1.5
What to do
Update Awesome Support to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023EventPrime: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5238 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
Product
EventPrime
Fixed in
3.2.0
What to do
Update EventPrime to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023Memberlite Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-5237 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Product
Memberlite Shortcodes
Fixed in
1.3.9
What to do
Update Memberlite Shortcodes to 1.3.9 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Oct 31, 2023Fattura24: Does not sanitize or escape the 'id' parameter before outputting it back in the pageCVE-2023-5211 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.
Product
Fattura24
Fixed in
6.2.8
What to do
Update Fattura24 to 6.2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023EventPrime: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-4250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
EventPrime
Fixed in
3.2.0
What to do
Update EventPrime to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 29, 2023A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress.CVE-2007-10003 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajax_blurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. Upgrading to version 0.9.7b is able to address this issue. The patch is named 7dd8acf7cd8442609840037121074425d363b694. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-243803.
Product
The Hackers Diet
Affected
up to 0.9.6b
What to do
Affects up to 0.9.6b. Update The Hackers Diet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Oct 27, 2023CallRail Phone Call Tracking: Stored Cross-Site ScriptingCVE-2023-5051 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the 'form_id' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CallRail Phone Call Tracking
Affected
up to 0.5.2
What to do
Affects up to 0.5.2. Update CallRail Phone Call Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 26, 2023Conversios Track Google Analytics 4, Facebook Pixel & Conversions API: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-46094 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.3 versions.
Product
Conversios Track Google Analytics 4, Facebook Pixel & Conversions API
Fixed in
6.5.4
What to do
Update Conversios Track Google Analytics 4, Facebook Pixel & Conversions API to 6.5.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lee Le @ Userback Userback plugin <= 1.0.13 versions.CVE-2023-46089 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Lee Le @ Userback Userback plugin <= 1.0.13 versions.
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023Migration, Backup, Staging – WPvivid: Stored Cross-Site ScriptingCVE-2023-5121 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.89
What to do
Affects up to 0.9.89. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Jetpack CRM: PHAR deserializationCVE-2022-3342 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link.
Product
Jetpack CRM
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Jetpack CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Migration, Backup, Staging - WPvivid: Sensitive Information ExposureCVE-2023-5576 · WordPress plugins & themes · reported by WordfenceHigh 8
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate the WPVivid Google Drive account via the API if they can trick a user into reauthenticating via another vulnerability or social engineering.
Product
Migration, Backup, Staging - WPvivid
Affected
up to 0.9.91
What to do
Affects up to 0.9.91. Update Migration, Backup, Staging - WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Migration, Backup, Staging – WPvivid: Stored Cross-Site ScriptingCVE-2023-5120 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.89
What to do
Affects up to 0.9.89. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Migration, Backup, Staging – WPvivid: Directory TraversalCVE-2023-4274 · WordPress plugins & themes · reported by WordfenceHigh 8.7
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authenticated attackers with administrative privileges to delete the contents of arbitrary directories on the server, which can be a critical issue in a shared environments.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.89
What to do
Affects up to 0.9.89. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of useCVE-2023-5561 · WordPress plugins & themes · reported by WPScanMedium 5.3
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lists.debian.org wpscan.com
Oct 16, 2023This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate itCVE-2023-5133 · WordPress plugins & themes · reported by WPScanHigh 7.5
This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Fixed in
2.3.4
What to do
Update the plugin to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Page Builder: Pagelayer: Doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5087 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code.
Product
Page Builder: Pagelayer
Fixed in
1.7.8
What to do
Update Page Builder: Pagelayer to 1.7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Testimonial Slider Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-4795 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Product
Testimonial Slider Shortcode
Fixed in
1.1.9
What to do
Update Testimonial Slider Shortcode to 1.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Magee Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4783 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Magee Shortcodes
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Magee Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Page Builder: Pagelayer: Doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled postsCVE-2023-4687 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts.
Product
Page Builder: Pagelayer
Fixed in
1.7.7
What to do
Update Page Builder: Pagelayer to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Simple Posts Ticker: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4646 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Simple Posts Ticker
Fixed in
1.1.6
What to do
Update Simple Posts Ticker to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Enable Media Replace: Unserializes user input via the Remove Background featureCVE-2023-4643 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog
Product
Enable Media Replace
Fixed in
4.1.3
What to do
Update Enable Media Replace to 4.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023WP Matterport Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4289 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Matterport Shortcode
Fixed in
2.1.8
What to do
Update WP Matterport Shortcode to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023WordPress Gallery: Is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` functionCVE-2023-3155 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
Product
WordPress Gallery
Fixed in
3.39
What to do
Update WordPress Gallery to 3.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023WordPress Gallery: Is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` functionCVE-2023-3154 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
Product
WordPress Gallery
Fixed in
3.39
What to do
Update WordPress Gallery to 3.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Bernhard Kau Backend Localization plugin <= 2.1.10 versions.CVE-2023-44471 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Bernhard Kau Backend Localization plugin <= 2.1.10 versions.
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 27, 2023Active Directory Integration / LDAP Integration: LDAP PassbackCVE-2023-4506 · WordPress plugins & themes · reported by WordfenceLow 2.2
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.
Product
Active Directory Integration / LDAP Integration
Affected
up to 4.1.10
What to do
Affects up to 4.1.10. Update Active Directory Integration / LDAP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com plugins.trac.wordpress.org
Sep 27, 2023Staff / Employee Business Directory for Active Directory: LDAP PassbackCVE-2023-4505 · WordPress plugins & themes · reported by WordfenceLow 2.2
The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.
Product
Staff / Employee Business Directory for Active Directory
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Staff / Employee Business Directory for Active Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com plugins.trac.wordpress.org
Sep 25, 2023Locatoraid Store Locator: Does not sanitise and escape the lpr-search parameter before outputting it back in the pageCVE-2023-4476 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Locatoraid Store Locator
Fixed in
3.9.24
What to do
Update Locatoraid Store Locator to 3.9.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.CVE-2023-4281 · WordPress plugins & themes · reported by WPScanMedium 5.3
This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Fixed in
2.8.8
What to do
Update the plugin to 2.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023Ditty: Does not sanitise and escape some parameters and generated URLs before outputting them back in attributesCVE-2023-4148 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Ditty
Fixed in
3.1.25
What to do
Update Ditty to 3.1.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023Min Max Control: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-4270 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Min Max Control
Fixed in
4.6
What to do
Update Min Max Control to 4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023gAppointments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2705 · WordPress plugins & themes · reported by WPScanMedium 6.1
The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin
Product
gAppointments
Fixed in
1.10.0
What to do
Update gAppointments to 1.10.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Post Timeline: Does not sanitise and escape an invalid nonce before outputting it back in an AJAX responseCVE-2023-4284 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Post Timeline
Fixed in
2.2.6
What to do
Update Post Timeline to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its vaCVE-2023-4279 · WordPress plugins & themes · reported by WPScanHigh 7.5
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
Fixed in
1.6.7
What to do
Update the plugin to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023User Activity Log: Lacks proper authorisationCVE-2023-4269 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
Product
User Activity Log
Fixed in
1.6.6
What to do
Update User Activity Log to 1.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Orders Tracking for WooCommerce: Doesn't validate the file_url parameterCVE-2023-4216 · WordPress plugins & themes · reported by WPScanLow 2.7
The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowing high privilege users with the manage_woocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file.
Product
Orders Tracking for WooCommerce
Fixed in
1.2.6
What to do
Update Orders Tracking for WooCommerce to 1.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.