Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
312 results · page 3 of 7
Apr 17, 2025Redirect wordpress to welcome or landing page: Cross-Site Request Forgery (CSRF)CVE-2025-39417 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Stored XSS.This issue affects Redirect wordpress to welcome or landing page: from n/a through <= 2.0.
- Product
- Redirect wordpress to welcome or landing page
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Redirect wordpress to welcome or landing page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Listdom: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39599 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Webilia Inc. Listdom listdom allows Phishing.This issue affects Listdom: from n/a through <= 4.0.0.
- Product
- Listdom
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Listdom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Fast eBay Listings: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39597 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Arthur Yarwood Fast eBay Listings fast-ebay-listings allows Phishing.This issue affects Fast eBay Listings: from n/a through <= 2.12.15.
- Product
- Fast eBay Listings
- Affected
- up to 2.12.15
- What to do
- Affects up to 2.12.15. Update Fast eBay Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Ultimate WP Mail: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-32694 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Phishing.This issue affects Ultimate WP Mail: from n/a through <= 1.3.10.
- Product
- Ultimate WP Mail
- Affected
- up to 1.3.10
- What to do
- Affects up to 1.3.10. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WebinarPress: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-32693 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Phishing.This issue affects WebinarPress: from n/a through <= 1.33.28.
- Product
- WebinarPress
- Affected
- up to 1.33.28
- What to do
- Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025Advanced Advertising System: Open RedirectCVE-2025-3433 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced Advertising System plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.3.1. This is due to insufficient validation on the redirect url supplied via the 'redir' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- Advanced Advertising System
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Advanced Advertising System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 4, 2025404 Image Redirection (Replace Broken Images): Cross-Site Request Forgery (CSRF)CVE-2025-32266 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) broken-images-redirection allows Cross Site Request Forgery.This issue affects 404 Image Redirection (Replace Broken Images): from n/a through <= 1.4.
- Product
- 404 Image Redirection (Replace Broken Images)
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update 404 Image Redirection (Replace Broken Images) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Clone any post type: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-31871 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Phishing.This issue affects WP Clone any post type: from n/a through <= 3.6.
- Product
- WP Clone any post type
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update WP Clone any post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Integration of Zoho CRM and Contact Form 7: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-31821 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integration of Zoho CRM and Contact Form 7 allows Phishing. This issue affects Integration of Zoho CRM and Contact Form 7: from n/a through 1.0.6.
- Product
- Integration of Zoho CRM and Contact Form 7
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Integration of Zoho CRM and Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Bit Form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30885 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Form bit-form allows Phishing.This issue affects Bit Form: from n/a through <= 2.18.0.
- Product
- Bit Form
- Affected
- up to 2.18.0
- What to do
- Affects up to 2.18.0. Update Bit Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Bit Integrations: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30884 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Integrations bit-integrations allows Phishing.This issue affects Bit Integrations: from n/a through <= 2.4.10.
- Product
- Bit Integrations
- Affected
- up to 2.4.10
- What to do
- Affects up to 2.4.10. Update Bit Integrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025AliNext: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30859 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in guru-aliexpress AliNext ali2woo-lite allows Phishing.This issue affects AliNext: from n/a through <= 3.5.1.
- Product
- AliNext
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update AliNext to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025FunnelKit Automations: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30795 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.5.1.
- Product
- FunnelKit Automations
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Scheduled & Automatic Order Status Controller for WooCommerce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30781 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order Status Controller for WooCommerce: from n/a through <= 3.7.1.
- Product
- Scheduled & Automatic Order Status Controller for WooCommerce
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Scheduled & Automatic Order Status Controller for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Login Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30575 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect login-redirect allows Stored XSS.This issue affects Login Redirect: from n/a through <= 1.0.5.
- Product
- Login Redirect
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Easy 301 Redirects: Cross-Site Request Forgery (CSRF)CVE-2025-30557 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in odihost Easy 301 Redirects odihost-easy-redirect-301 allows Cross Site Request Forgery.This issue affects Easy 301 Redirects: from n/a through <= 1.33.
- Product
- Easy 301 Redirects
- Affected
- up to 1.33
- What to do
- Affects up to 1.33. Update Easy 301 Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025AS English Admin: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-28896 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects AS English Admin: from n/a through <= 1.0.0.
- Product
- AS English Admin
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update AS English Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025First Comment Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23852 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robin90 First Comment Redirect first-comment-redirect allows Reflected XSS.This issue affects First Comment Redirect: from n/a through <= 1.0.3.
- Product
- First Comment Redirect
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update First Comment Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2025IP2Location Redirection: Unauthorized access of dataCVE-2025-1502 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_redirection_backup' AJAX action in all versions up to, and including, 1.33.3. This makes it possible for unauthenticated attackers to download the plugin's settings.
- Product
- IP2Location Redirection
- Affected
- up to 1.33.3
- What to do
- Affects up to 1.33.3. Update IP2Location Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 24, 2025WPO365 | MICROSOFT 365 GRAPH MAILER: Open RedirectCVE-2025-1488 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if 1. they can successfully trick them into performing an action and 2. the plugin is activated but not configured.
- Product
- WPO365 | MICROSOFT 365 GRAPH MAILER
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update WPO365 | MICROSOFT 365 GRAPH MAILER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 20, 2025WPMobile.App: Open RedirectCVE-2024-13888 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- WPMobile.App
- Affected
- up to 11.56
- What to do
- Affects up to 11.56. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 19, 2025Trash Duplicate and 301 Redirect: Unauthorized loss of dataCVE-2024-13468 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-action-top' action in all versions up to, and including, 1.9. This makes it possible for unauthenticated attackers to delete arbitrary posts/pages.
- Product
- Trash Duplicate and 301 Redirect
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Trash Duplicate and 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 31, 2025The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login URL – Sign in , Sign out plugin for WordCVE-2024-13530 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login URL – Sign in , Sign out plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the lps_handle_delete_all_logs(), lps_handle_delete_login_log(), and lps_handle_end_session() functions in all versions up to, and including, 7.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete login logs and end user sessions.
- Affected
- up to 7.1.1
- What to do
- Affects up to 7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2025KB Support: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24741 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in LOGON KB Support kb-support.This issue affects KB Support: from n/a through <= 1.6.7.
- Product
- KB Support
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update KB Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025LearnPress: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24740 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress learnpress.This issue affects LearnPress: from n/a through <= 4.2.7.1.
- Product
- LearnPress
- Affected
- up to 4.2.7.1
- What to do
- Affects up to 4.2.7.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025SEO Blogger to WordPress Migration using 301 Redirection: Reflected Cross-Site ScriptingCVE-2024-13422 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- SEO Blogger to WordPress Migration using 301 Redirection
- Affected
- up to 0.4.8
- What to do
- Affects up to 0.4.8. Update SEO Blogger to WordPress Migration using 301 Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 22, 2025REDIRECTION PLUS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23681 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat REDIRECTION PLUS redirection-plus allows Reflected XSS.This issue affects REDIRECTION PLUS: from n/a through <= 2.0.0.
- Product
- REDIRECTION PLUS
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update REDIRECTION PLUS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Contact Form 7 Redirect & Thank You Page: Reflected Cross-Site ScriptingCVE-2024-12423 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Contact Form 7 Redirect & Thank You Page
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Contact Form 7 Redirect & Thank You Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2024Maintenance & Coming Soon Redirect Animation: Unauthorized modification of dataCVE-2024-9503 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wploti_add_whitelisted_roles_option', 'wploti_remove_whitelisted_roles_option', 'wploti_add_whitelisted_users_option', 'wploti_remove_whitelisted_users_option', and 'wploti_uploaded_animation_save_option' functions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify certain plugin settings.
- Product
- Maintenance & Coming Soon Redirect Animation
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Maintenance & Coming Soon Redirect Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024Redirection for Contact Form 7: Missing AuthorizationCVE-2023-39920 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 wpcf7-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through <= 2.9.2.
- Product
- Redirection for Contact Form 7
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Login Widget With Shortcode: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-54255 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue affects Login Widget With Shortcode: from n/a through <= 6.1.2.
- Product
- Login Widget With Shortcode
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update Login Widget With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Redirects: Missing AuthorizationCVE-2023-49845 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mattdeclaire Redirects redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirects: from n/a through <= 1.2.1.
- Product
- Redirects
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Simple 301 Redirects by BetterLinks: Missing AuthorizationCVE-2023-47761 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks simple-301-redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple 301 Redirects by BetterLinks: from n/a through <= 2.0.7.
- Product
- Simple 301 Redirects by BetterLinks
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Simple 301 Redirects by BetterLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2024Simple Redirection: Cross-Site Request ForgeryCVE-2024-11341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and redirect all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Simple Redirection
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Simple Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 19, 2024Redirecter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51855 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Productineer Redirecter shortcode-for-redirection allows DOM-Based XSS.This issue affects Redirecter: from n/a through <= 1.0.
- Product
- Redirecter
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Redirecter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Blogger 301 Redirect: Blind time-based SQL InjectionCVE-2024-10645 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Blogger 301 Redirect plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘br’ parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Blogger 301 Redirect
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Blogger 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 11, 2024Contact Form 7 Redirect & Thank You Page: Reflected Cross-Site ScriptingCVE-2024-10685 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Contact Form 7 Redirect & Thank You Page
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Contact Form 7 Redirect & Thank You Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 28, 2024Sunshine Photo Cart: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-50463 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2024Simple Membership: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-49682 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership simple-membership allows Phishing.This issue affects Simple Membership: from n/a through <= 4.5.3.
- Product
- Simple Membership
- Affected
- up to 4.5.3
- What to do
- Affects up to 4.5.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2024ElementsReady Addons for Elementor: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47353 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite.This issue affects ElementsReady Addons for Elementor: from n/a through 6.4.2.
- Product
- ElementsReady Addons for Elementor
- Affected
- up to 6.4.2
- What to do
- Affects up to 6.4.2. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2024EventPrime: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47648 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Metagauss EventPrime eventprime-event-calendar-management.This issue affects EventPrime: from n/a through <= 4.0.4.5.
- Product
- EventPrime
- Affected
- up to 4.0.4.5
- What to do
- Affects up to 4.0.4.5. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2024Simple Membership After Login Redirection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47354 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirection.This issue affects Simple Membership After Login Redirection: from n/a through <= 1.6.
- Product
- Simple Membership After Login Redirection
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Simple Membership After Login Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Payflex Payment Gateway: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-47646 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in tomlister Payflex Payment Gateway payflex-payment-gateway.This issue affects Payflex Payment Gateway: from n/a through <= 2.6.1.
- Product
- Payflex Payment Gateway
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Payflex Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2024Maintenance Redirect: Authentication Bypass by SpoofingCVE-2024-45453 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in Peter Hardy-vanDoorn Maintenance Redirect jf3-maintenance-mode.This issue affects Maintenance Redirect: from n/a through <= 2.0.1.
- Product
- Maintenance Redirect
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Maintenance Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Share This Image: Open RedirectCVE-2024-8761 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. This is due to insufficient validation on the redirect url supplied via the link parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- Share This Image
- Affected
- up to 2.03
- What to do
- Affects up to 2.03. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024Maintenance & Coming Soon Redirect Animation: Authentication Bypass by SpoofingCVE-2024-43944 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in ilyasine Maintenance & Coming Soon Redirect Animation maintenance-coming-soon-redirect-animation allows Identity Spoofing.This issue affects Maintenance & Coming Soon Redirect Animation: from n/a through <= 2.3.3.
- Product
- Maintenance & Coming Soon Redirect Animation
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Maintenance & Coming Soon Redirect Animation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Salon booking system: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-43280 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.8.1.
- Product
- Salon booking system
- Affected
- up to 10.8.1
- What to do
- Affects up to 10.8.1. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Easy PayPal Buy Now Button: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-43236 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Easy PayPal Buy Now Button.This issue affects Easy PayPal Buy Now Button: from n/a through 1.9.
- Product
- Easy PayPal Buy Now Button
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Easy PayPal Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2024Hide My WP Ghost: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2024-6420 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
- Product
- Hide My WP Ghost
- Fixed in
- 5.2.02
- What to do
- Update Hide My WP Ghost to 5.2.02 or newer.
Jul 22, 2024All In One Redirection: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37245 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Reflected XSS.This issue affects All In One Redirection: from n/a through 2.2.0.
- Product
- All In One Redirection
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update All In One Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.