Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

200 results · page 3 of 4

Jul 4, 2024Elementor Addons by Livemesh: Local File InclusionCVE-2024-2385 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.4 via several of the plugin's widgets through the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVE-2024-37547 is likely a duplicate of this issue.
Product
Elementor Addons by Livemesh
Affected
up to 8.4
What to do
Affects up to 8.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024Slideshow SE: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35778 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in John West Slideshow SE PHP Local File Inclusion.This issue affects Slideshow SE: from n/a through 2.5.17.
Product
Slideshow SE
Affected
up to 2.5.17
What to do
Affects up to 2.5.17. Update Slideshow SE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Slideshow SE: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35769 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in John West Slideshow SE allows Stored XSS.This issue affects Slideshow SE: from n/a through 2.5.17.
Product
Slideshow SE
Affected
up to 2.5.17
What to do
Affects up to 2.5.17. Update Slideshow SE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Slideshow Gallery LITE: Time-based SQL InjectionCVE-2024-5543 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Slideshow Gallery LITE plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Slideshow Gallery LITE
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Slideshow Gallery LITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2024Slider Responsive Slideshow – Image slider, Gallery slideshow: Missing AuthorizationCVE-2024-35722 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: from n/a through 1.4.0.
Product
Slider Responsive Slideshow – Image slider, Gallery slideshow
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Slider Responsive Slideshow – Image slider, Gallery slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: Missing AuthorizationCVE-2024-35717 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9.
Product
Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024SimpleShop: Cross-Site Request ForgeryCVE-2024-1230 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybe_disconnect_simpleshop function. This makes it possible for unauthenticated attackers to disconnect the site from simpleshop via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
SimpleShop
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update SimpleShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 14, 2024SimpleShop: Unauthorized disconnection from SimpleShopCVE-2024-1229 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SimpleShop plugin for WordPress is vulnerable to unauthorized disconnection from SimpleShop due to a missing capability check on the maybe_disconnect_simpleshop function in all versions up to, and including, 2.10.2. This makes it possible for unauthenticated attackers to disconnect the SimpleShop.
Product
SimpleShop
Affected
up to 2.10.2
What to do
Affects up to 2.10.2. Update SimpleShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2024Freshdesk (official): URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-32129 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Freshworks Freshdesk (official).This issue affects Freshdesk (official): from n/a through 2.3.6.
Product
Freshdesk (official)
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Freshdesk (official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 12, 2024Slideshow Gallery: Cross-Site Request Forgery (CSRF)CVE-2024-31354 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
Product
Slideshow Gallery
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2024Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows: Stored Cross-Site ScriptingCVE-2024-3285 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'metaslider' shortcode in all versions up to, and including, 3.70.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows
Affected
up to 3.70.0
What to do
Affects up to 3.70.0. Update Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024Slideshow Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31355 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
Product
Slideshow Gallery
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Slideshow Gallery: Insertion of Sensitive Information into Log FileCVE-2024-31353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
Product
Slideshow Gallery
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-2655 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post widgets in all versions up to, and including, 8.3.5 due to insufficient input sanitization and output escaping on author display names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.5
What to do
Affects up to 8.3.5. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-2539 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget '_id' attributes in all versions up to, and including, 8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.6
What to do
Affects up to 8.3.6. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1466 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_style’ attribute of the Posts Multislider widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-27986 may be a duplicate of this issue.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1465 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘carousel_skin’ attribute of the Posts Carousel widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1464 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Posts Slider widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1461 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Team Members widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘text_alignment’ attribute of the Animated Text widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.4
What to do
Affects up to 8.3.4. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2024Livemesh Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30183 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for WPBakery Page Builder allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through 3.7.
Product
Livemesh Addons for WPBakery Page Builder
Affected
up to 3.7
What to do
Affects up to 3.7. Update Livemesh Addons for WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 15, 2024Livemesh Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for Elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through 8.3.
Product
Livemesh Addons for Elementor
Affected
up to 8.3
What to do
Affects up to 8.3. Update Livemesh Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 14, 2024Elementor Addons by Livemesh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27986 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Elementor Addons by Livemesh allows Stored XSS.This issue affects Elementor Addons by Livemesh: from n/a through 8.3.5.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.5
What to do
Affects up to 8.3.5. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024WPBakery Page Builder Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-2079 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mobile' shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPBakery Page Builder Addons by Livemesh
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update WPBakery Page Builder Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2024Auto Refresh Single Page: PHP Object InjectionCVE-2024-1731 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arsp_options post meta option. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Auto Refresh Single Page
Affected
up to 1.1
What to do
Affects up to 1.1. Update Auto Refresh Single Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 1, 2024Slider Responsive Slideshow – Image slider, Gallery slideshow: PHP Object InjectionCVE-2024-1859 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization of untrusted input to the awl_slider_responsive_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Slider Responsive Slideshow – Image slider, Gallery slideshow
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Slider Responsive Slideshow – Image slider, Gallery slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-1235 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom class field in all versions up to, and including, 8.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.2
What to do
Affects up to 8.3.2. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Elementor Addons by Livemesh: Stored Cross-Site ScriptingCVE-2024-0448 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget URL parameters in all versions up to, and including, 8.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elementor Addons by Livemesh
Affected
up to 8.3.1
What to do
Affects up to 8.3.1. Update Elementor Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24866 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Reflected XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24.
Product
Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
Affected
up to 2.2.24
What to do
Affects up to 2.2.24. Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024FreshMail For: Cross-Site Request Forgery (CSRF)CVE-2024-22304 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2.
Product
FreshMail For
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update FreshMail For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 29, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the pageCVE-2023-6278 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
Fixed in
2.2.25
What to do
Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to 2.2.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2024URL Shortener by MyThemeShop: Missing AuthorizationCVE-2023-23896 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17.
Product
URL Shortener by MyThemeShop
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update URL Shortener by MyThemeShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Slideshow Gallery LITE: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28491 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6.
Product
Slideshow Gallery LITE
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Slideshow Gallery LITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Image horizontal reel scroll slideshow: Stored Cross-Site ScriptingCVE-2023-5413 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, and including, 13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image horizontal reel scroll slideshow
Affected
up to 13.3
What to do
Affects up to 13.3. Update Image horizontal reel scroll slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 15, 2023Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49767 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Stored XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24.
Product
Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
Affected
up to 2.2.24
What to do
Affects up to 2.2.24. Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023WPBakery Page Builder Addons by Livemesh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50370 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons by Livemesh allows Stored XSS.This issue affects WPBakery Page Builder Addons by Livemesh: from n/a through 3.5.
Product
WPBakery Page Builder Addons by Livemesh
Affected
up to 3.5
What to do
Affects up to 3.5. Update WPBakery Page Builder Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5 CVE-2023-47811 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5 versions.
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <= 1.7.6 versions.CVE-2023-28497 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <= 1.7.6 versions.
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <= 1.4.16 versions.CVE-2023-28495 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <= 1.4.16 versions.
Affected
up to 1.4.16
What to do
Affects up to 1.4.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 3, 2023Neshan Maps: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-47426 · WordPress plugins & themes · reported by PatchstackMedium 6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Neshan Maps Platform Neshan Maps neshan-maps allows SQL Injection.This issue affects Neshan Maps: from n/a through 1.1.4.
Product
Neshan Maps
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Neshan Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Jquery accordion slideshow: SQL InjectionCVE-2023-5464 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Jquery accordion slideshow
Affected
up to 8.1
What to do
Affects up to 8.1. Update Jquery accordion slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023wp image slideshow: SQL InjectionCVE-2023-5438 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
wp image slideshow
Affected
up to 12.0
What to do
Affects up to 12.0. Update wp image slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023Up down image slideshow gallery: SQL InjectionCVE-2023-5435 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Up down image slideshow gallery
Affected
up to 12.0
What to do
Affects up to 12.0. Update Up down image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023Superb slideshow gallery: SQL InjectionCVE-2023-5434 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Superb slideshow gallery
Affected
up to 13.1
What to do
Affects up to 13.1. Update Superb slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023Left right image slideshow gallery: SQL InjectionCVE-2023-5431 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Left right image slideshow gallery
Affected
up to 12.0
What to do
Affects up to 12.0. Update Left right image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023Image vertical reel scroll slideshow: SQL InjectionCVE-2023-5428 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Image vertical reel scroll slideshow
Affected
up to 9.0
What to do
Affects up to 9.0. Update Image vertical reel scroll slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023Image horizontal reel scroll slideshow: SQL InjectionCVE-2023-5412 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Image horizontal reel scroll slideshow
Affected
up to 13.2
What to do
Affects up to 13.2. Update Image horizontal reel scroll slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions.CVE-2023-45643 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Naresh Parmar Post View Count plugin <= 1.8.2 versions.CVE-2023-44996 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Naresh Parmar Post View Count plugin <= 1.8.2 versions.
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki Block Plugin Update plugin <= 3.3 versions.CVE-2023-44261 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki Block Plugin Update plugin <= 3.3 versions.
Affected
up to 3.3
What to do
Affects up to 3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.