Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

179 results · page 3 of 4

Nov 19, 2024WordPress GDPR: Unauthorized loss of dataCVE-2024-11069 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users.
Product
WordPress GDPR
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update WordPress GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record welaunch.io wordfence.com
Nov 19, 2024WordPress GDPR: Stored Cross-Site ScriptingCVE-2024-10388 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress GDPR
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update WordPress GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record welaunch.io wordfence.com
Oct 9, 2024GDPR-Extensions-com – Consent Manager: Stored Cross-Site ScriptingCVE-2024-9072 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GDPR-Extensions-com – Consent Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
GDPR-Extensions-com – Consent Manager
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update GDPR-Extensions-com – Consent Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 31, 2024tagDiv Composer: Reflected Cross-Site ScriptingCVE-2024-5212 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_register_forum_user function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
tagDiv Composer
Affected
up to 5.0
What to do
Affects up to 5.0. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Aug 31, 2024tagDiv Composer: Reflected Cross-Site ScriptingCVE-2024-3886 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping within the on_ajax_check_envato_code function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
tagDiv Composer
Affected
up to 5.0
What to do
Affects up to 5.0. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Aug 17, 2024tagDiv Opt-In Builder: Blind SQL InjectionCVE-2023-3419 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'couponId' parameter of the 'recreate_stripe_subscription' REST API endpoint in versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
tagDiv Opt-In Builder
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update tagDiv Opt-In Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Aug 17, 2024tagDiv Opt-In Builder: Blind SQL InjectionCVE-2023-3416 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'subscriptionCouponId' parameter via the 'create_stripe_subscription' REST API endpoint in versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
tagDiv Opt-In Builder
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update tagDiv Opt-In Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Aug 15, 2024Cookie Notice & Compliance for GDPR / CCPA: Stored Cross-Site ScriptingCVE-2022-3399 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cookie_notice_options[refuse_code_head]' parameter in versions up to, and including, 2.4.17.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected /wp-admin/admin.php?page=cookie-notice page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Cookie Notice & Compliance for GDPR / CCPA
Affected
up to 2.4.17.1
What to do
Affects up to 2.4.17.1. Update Cookie Notice & Compliance for GDPR / CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2024GD Rating System: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38709 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Milan Petrovic GD Rating System allows PHP Local File Inclusion.This issue affects GD Rating System: from n/a through 3.6.
Product
GD Rating System
Affected
up to 3.6
What to do
Affects up to 3.6. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 25, 2024WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): Stored Cross-Site ScriptingCVE-2024-4869 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024tagDiv Composer: Stored Cross-Site ScriptingCVE-2024-3814 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
tagDiv Composer
Affected
up to 4.8
What to do
Affects up to 4.8. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Jun 14, 2024tagDiv Composer: Local File InclusionCVE-2024-3813 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'td_block_title' shortcode 'block_template_id' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
tagDiv Composer
Affected
up to 4.8
What to do
Affects up to 4.8. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Jun 6, 2024GDPR CCPA Compliance & Cookie Consent Banner: Unauthorized modification of dataCVE-2024-5607 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings() in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings, update page content, send arbitrary emails and inject malicious web scripts.
Product
GDPR CCPA Compliance & Cookie Consent Banner
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update GDPR CCPA Compliance & Cookie Consent Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 4, 2024tagDiv Composer: Stored Cross-Site ScriptingCVE-2024-3888 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button shortcode in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: The vulnerable code in this plugin is specifically tied to the tagDiv Newspaper theme. If another theme is installed (e.g., NewsMag), this code may not be present.
Product
tagDiv Composer
Affected
up to 4.8
What to do
Affects up to 4.8. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
May 22, 2024WP DSGVO Tools (GDPR): Stored Cross-Site ScriptingCVE-2024-3201 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pp_link' shortcode in all versions up to, and including, 3.1.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP DSGVO Tools (GDPR)
Affected
up to 3.1.32
What to do
Affects up to 3.1.32. Update WP DSGVO Tools (GDPR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 6, 2024GDPR Compliance: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-34388 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5.
Product
GDPR Compliance
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update GDPR Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): Unauthorized loss of dataCVE-2024-3599 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the gdpr_policy_process_delete() function in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to delete arbitrary posts.
Product
WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 26, 2024WP GDPR Compliance: Cross-Site Request Forgery (CSRF)CVE-2024-33682 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cookie Information A/S WP GDPR Compliance.This issue affects WP GDPR Compliance: from n/a through 2.0.23.
Product
WP GDPR Compliance
Affected
up to 2.0.23
What to do
Affects up to 2.0.23. Update WP GDPR Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024WP-Eggdrop: Cross-Site Request ForgeryCVE-2024-2969 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the wpegg_updateOptions() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP-Eggdrop
Affected
up to 0.1
What to do
Affects up to 0.1. Update WP-Eggdrop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2024WP-Eggdrop: Stored Cross-Site ScriptingCVE-2024-2968 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP-Eggdrop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP-Eggdrop
Affected
up to 0.1
What to do
Affects up to 0.1. Update WP-Eggdrop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 2, 2024Complianz – GDPR/CCPA Cookie Consent: Cross-Site Request ForgeryCVE-2024-1592 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.6. This is due to missing or incorrect nonce validation on the process_delete function in class-DNSMPD.php. This makes it possible for unauthenticated attackers to delete GDPR data requests via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Complianz – GDPR/CCPA Cookie Consent
Affected
up to 6.5.6
What to do
Affects up to 6.5.6. Update Complianz – GDPR/CCPA Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 29, 2024GD Rating System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25093 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Rating System allows Stored XSS.This issue affects GD Rating System: from n/a through 3.5.
Product
GD Rating System
Affected
up to 3.5
What to do
Affects up to 3.5. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 10, 2024My Agile Privacy – The only GDPR solution for WordPress that you can truly trust: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51404 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MyAgilePrivacy My Agile Privacy – The only GDPR solution for WordPress that you can truly trust allows Stored XSS.This issue affects My Agile Privacy – The only GDPR solution for WordPress that you can truly trust: from n/a through 2.1.7.
Product
My Agile Privacy – The only GDPR solution for WordPress that you can truly trust
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update My Agile Privacy – The only GDPR solution for WordPress that you can truly trust to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2024GDPR Data Request Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24836 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Audrasjb GDPR Data Request Form allows Stored XSS.This issue affects GDPR Data Request Form: from n/a through 1.6.
Product
GDPR Data Request Form
Affected
up to 1.6
What to do
Affects up to 1.6. Update GDPR Data Request Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 5, 2024Cookie Information | Free GDPR Consent Solution: Arbitrary option updatesCVE-2023-6700 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level access or higher, to edit arbitrary site options which can be used to create administrator accounts.
Product
Cookie Information | Free GDPR Consent Solution
Affected
up to 2.0.22
What to do
Affects up to 2.0.22. Update Cookie Information | Free GDPR Consent Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 3, 2024Complianz – GDPR/CCPA Cookie Consent: Stored Cross-Site ScriptingCVE-2023-6498 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 6.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Complianz – GDPR/CCPA Cookie Consent
Affected
up to 6.5.5
What to do
Affects up to 6.5.5. Update Complianz – GDPR/CCPA Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 3, 2024OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: Unauthorized modification of data and Stored Cross-Site ScriptingCVE-2023-6600 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease note there were several attempted patched, and we consider 5.7.10 to be the most sufficiently patched.
Product
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Affected
up to 5.7.9
What to do
Affects up to 5.7.9. Update OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 15, 2023GDPR Cookie Consent by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49191 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.This issue affects GDPR Cookie Consent by Supsystic: from n/a through 2.1.2.
Product
GDPR Cookie Consent by Supsystic
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update GDPR Cookie Consent by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3CVE-2023-47824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions.
Fixed in
1.3.9
What to do
Update the plugin to 1.3.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 13, 2023tagDiv Composer: Cross-Site Request Forgery (CSRF)CVE-2023-39166 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in tagDiv tagDiv Composer allows Cross-Site Scripting (XSS).This issue affects tagDiv Composer: from n/a before 4.4.
Product
tagDiv Composer
Fixed in
4.4
What to do
Update tagDiv Composer to 4.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): Improper Neutralization of Formula Elements in a CSV FileCVE-2023-23678 · WordPress plugins & themes · reported by PatchstackMedium 4
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): from n/a through 2.2.5.
Product
WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.CVE-2023-5823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023GD Security Headers: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-46821 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers allows auth. (admin+) SQL Injection.This issue affects GD Security Headers: from n/a through 1.7.
Product
GD Security Headers
Affected
up to 1.7
What to do
Affects up to 1.7. Update GD Security Headers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settingsCVE-2023-3170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
tagDiv Composer
Fixed in
4.2
What to do
Update tagDiv Composer to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST routCVE-2023-3169 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.
Product
tagDiv Composer
Fixed in
4.2
What to do
Update tagDiv Composer to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent): Does not have proper CSRF checksCVE-2023-4013 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
Product
GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent)
Fixed in
4.12.5
What to do
Update GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) to 4.12.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2023GD Mail Queue: Stored Cross-Site ScriptingCVE-2023-3122 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GD Mail Queue
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update GD Mail Queue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 10, 2023tagDiv Cloud Library: Does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated usersCVE-2023-1597 · WordPress plugins & themes · reported by WPScanHigh 8.8
The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.
Product
tagDiv Cloud Library
Fixed in
2.7
What to do
Update tagDiv Cloud Library to 2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 6, 2023WP DSGVO Tools (GDPR): Stored Cross-Site ScriptingCVE-2021-4358 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP DSGVO Tools (GDPR)
Affected
up to 3.1.23
What to do
Affects up to 3.1.23. Update WP DSGVO Tools (GDPR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023Ultimate GDPR & CCPA: Unauthenticated settings import and exportCVE-2021-4348 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks such as redirecting visitors to malicious sites.
Product
Ultimate GDPR & CCPA
Affected
up to 2.4
What to do
Affects up to 2.4. Update Ultimate GDPR & CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023GDPR CCPA Compliance Support: PHP Object InjectionCVE-2020-36718 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows unauthenticated attackers to inject a PHP Object.
Product
GDPR CCPA Compliance Support
Affected
up to 2.3
What to do
Affects up to 2.3. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023WP GDPR: Authorization bypassCVE-2020-36697 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings.
Product
WP GDPR
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update WP GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com acunetix.com
Jun 6, 2023GDPR Cookie Compliance: Authorization bypassCVE-2019-25143 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_settings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings.
Product
GDPR Cookie Compliance
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update GDPR Cookie Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes GDPR Compliance & Cookie Consent plugin <= 1.2 versions.CVE-2022-45815 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes GDPR Compliance & Cookie Consent plugin <= 1.2 versions.
Affected
up to 1.2
What to do
Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2023tagDiv Composer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-1596 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
tagDiv Composer
Fixed in
4.0
What to do
Update tagDiv Composer to 4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Cookie Notice & Compliance for GDPR / CCPA: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0823 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Cookie Notice & Compliance for GDPR / CCPA
Fixed in
2.4.7
What to do
Update Cookie Notice & Compliance for GDPR / CCPA to 2.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023EU Cookie Law for GDPR/CCPA: Does not sanitise and escape some of its settingsCVE-2022-3811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
EU Cookie Law for GDPR/CCPA
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update EU Cookie Law for GDPR/CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 14, 2022tagDiv Composer WordPress plugin before 3.5, required by the Newspaper: And Newsmag WordPress theme before 5CVE-2022-3477 · WordPress plugins & themes · reported by WPScanCritical 9.8
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
Product
tagDiv Composer WordPress plugin before 3.5, required by the Newspaper
Fixed in
3.5
What to do
Update tagDiv Composer WordPress plugin before 3.5, required by the Newspaper to 3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022GD Mylist: Does not sanitise and escape some of its settingsCVE-2022-0703 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
GD Mylist
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update GD Mylist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Cookie Information | Free GDPR Consent Solution
Fixed in
2.0.8
What to do
Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.