Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

548new WordPress flaws this week

397,870entries in the database

24,646 results · page 339 of 493

Nov 9, 2024Ajax Content Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51717 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perception System System Pvt. Ltd. Ajax Content Filter ajax-content-filter allows Reflected XSS.This issue affects Ajax Content Filter: from n/a through <= 1.0.
Product
Ajax Content Filter
Affected
up to 1.0
What to do
Affects up to 1.0. Update Ajax Content Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Twitter real time search scrolling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51716 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Twitter real time search scrolling twitter-real-time-search-scrolling allows Reflected XSS.This issue affects Twitter real time search scrolling: from n/a through <= 7.0.
Product
Twitter real time search scrolling
Affected
up to 7.0
What to do
Affects up to 7.0. Update Twitter real time search scrolling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024User Password Reset: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51714 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techdabang User Password Reset user-password-reset allows Reflected XSS.This issue affects User Password Reset: from n/a through <= 1.0.
Product
User Password Reset
Affected
up to 1.0
What to do
Affects up to 1.0. Update User Password Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024HQ60 Fidelity Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51713 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TRe Technology And Research S.r.l. HQ60 Fidelity Card hq60-fidelity-card allows Reflected XSS.This issue affects HQ60 Fidelity Card: from n/a through <= 1.8.
Product
HQ60 Fidelity Card
Affected
up to 1.8
What to do
Affects up to 1.8. Update HQ60 Fidelity Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Jigoshop – Store Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51712 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Visser Jigoshop – Store Toolkit jigoshop-store-toolkit allows Reflected XSS.This issue affects Jigoshop – Store Toolkit: from n/a through <= 1.4.0.
Product
Jigoshop – Store Toolkit
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Jigoshop – Store Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Saragna: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51711 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Khunt Saragna saragna-social-stream allows Reflected XSS.This issue affects Saragna: from n/a through <= 1.0.
Product
Saragna
Affected
up to 1.0
What to do
Affects up to 1.0. Update Saragna to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Responsive Data Table: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51710 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Minerva Infotech Responsive Data Table responsive-data-table allows Reflected XSS.This issue affects Responsive Data Table: from n/a through <= 1.3.
Product
Responsive Data Table
Affected
up to 1.3
What to do
Affects up to 1.3. Update Responsive Data Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024TeleAdmin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51709 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mariandz TeleAdmin teleadmin allows Reflected XSS.This issue affects TeleAdmin: from n/a through <= 1.0.0.
Product
TeleAdmin
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update TeleAdmin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Narnoo Commerce Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51708 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Narnoo Narnoo Commerce Manager narnoo-commerce-manager allows Reflected XSS.This issue affects Narnoo Commerce Manager: from n/a through <= 1.6.0.
Product
Narnoo Commerce Manager
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Narnoo Commerce Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024WP Visual Adverts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51707 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodin WP Visual Adverts wp-visual-adverts allows Reflected XSS.This issue affects WP Visual Adverts: from n/a through <= 2.3.0.
Product
WP Visual Adverts
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WP Visual Adverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024The FOX – Currency Switcher Professional for WooCommerce: Arbitrary shortcode executionCVE-2024-10640 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.2.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The FOX – Currency Switcher Professional for WooCommerce
Affected
up to 1.4.2.2
What to do
Affects up to 1.4.2.2. Update The FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Magical Addons For Elementor: Sensitive Information ExposureCVE-2024-10352 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the get_content_type function in includes/widgets/content-reveal.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
Magical Addons For Elementor
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction: Arbitrary shortcode executionCVE-2024-10261 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.13.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Affected
up to 2.13.0
What to do
Affects up to 2.13.0. Update The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Firework Shoppable Live Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51781 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefan Backor Firework Shoppable Live Video firework-videos allows Reflected XSS.This issue affects Firework Shoppable Live Video: from n/a through <= 6.3.
Product
Firework Shoppable Live Video
Affected
up to 6.3
What to do
Affects up to 6.3. Update Firework Shoppable Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024eewee admin custom: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51780 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eewee eewee admin custom eewee-admincustom allows Reflected XSS.This issue affects eewee admin custom: from n/a through <= 1.8.2.4.
Product
eewee admin custom
Affected
up to 1.8.2.4
What to do
Affects up to 1.8.2.4. Update eewee admin custom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Don't Break The Code: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51779 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Coleman Don't Break The Code dont-break-the-code allows Reflected XSS.This issue affects Don't Break The Code: from n/a through <= .3.1.
Product
Don't Break The Code
What to do
Update Don't Break The Code to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Satisfaction Reports from Help Scout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51778 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tevya Satisfaction Reports from Help Scout happiness-reports-for-help-scout allows Reflected XSS.This issue affects Satisfaction Reports from Help Scout: from n/a through <= 2.0.3.
Product
Satisfaction Reports from Help Scout
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Satisfaction Reports from Help Scout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Daily Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51776 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Hotchkiss Daily Image daily-image allows Reflected XSS.This issue affects Daily Image: from n/a through <= 1.0.
Product
Daily Image
Affected
up to 1.0
What to do
Affects up to 1.0. Update Daily Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Team Showcase and Slider – Team Members Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biplob018 Team Showcase and Slider – Team Members Builder team-showcase-ultimate allows Reflected XSS.This issue affects Team Showcase and Slider – Team Members Builder: from n/a through <= 1.3.
Product
Team Showcase and Slider – Team Members Builder
Affected
up to 1.3
What to do
Affects up to 1.3. Update Team Showcase and Slider – Team Members Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024PropertyShift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51762 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Gipple PropertyShift propertyshift allows Reflected XSS.This issue affects PropertyShift: from n/a through <= 1.0.0.
Product
PropertyShift
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update PropertyShift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024RSVP ME: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50544 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MicahBlu RSVP ME rsvp-me allows SQL Injection.This issue affects RSVP ME: from n/a through <= 1.9.9.
Product
RSVP ME
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update RSVP ME to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Lodgix.com Vacation Rental Website Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50539 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in lodgix Lodgix.com Vacation Rental Website Builder lodgixcom-vacation-rental-listing-management-booking-plugin allows SQL Injection.This issue affects Lodgix.com Vacation Rental Website Builder: from n/a through <= 3.9.73.
Product
Lodgix.com Vacation Rental Website Builder
Affected
up to 3.9.73
What to do
Affects up to 3.9.73. Update Lodgix.com Vacation Rental Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Administrator Z: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50524 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Quý Lê 91 Administrator Z administrator-z allows Blind SQL Injection.This issue affects Administrator Z: from n/a through < 2024.10.21.
Product
Administrator Z
What to do
Update Administrator Z to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Conversion Helper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-10676 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wojciechborowicz Conversion Helper conversion-helper allows Reflected XSS.This issue affects Conversion Helper: from n/a through <= 1.12.
Product
Conversion Helper
Affected
up to 1.12
What to do
Affects up to 1.12. Update Conversion Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024ElementsReady Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51787 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows Stored XSS.This issue affects ElementsReady Addons for Elementor: from n/a through <= 6.4.3.
Product
ElementsReady Addons for Elementor
Affected
up to 6.4.3
What to do
Affects up to 6.4.3. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Realty by BestWebSoft: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51786 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Realty by BestWebSoft realty allows Stored XSS.This issue affects Realty by BestWebSoft: from n/a through <= 1.1.5.
Product
Realty by BestWebSoft
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Realty by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024FriendStore for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51784 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VietFriend team FriendStore for WooCommerce friendstore-for-woocommerce allows Reflected XSS.This issue affects FriendStore for WooCommerce: from n/a through <= 1.4.2.
Product
FriendStore for WooCommerce
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update FriendStore for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Forms: 3rd-Party Post Again: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51783 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zaus Forms: 3rd-Party Post Again forms-3rdparty-post-again allows Reflected XSS.This issue affects Forms: 3rd-Party Post Again: from n/a through <= 0.3.
Product
Forms: 3rd-Party Post Again
Affected
up to 0.3
What to do
Affects up to 0.3. Update Forms: 3rd-Party Post Again to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Loginplus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51782 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sanjay Prasad Loginplus loginplus allows Stored XSS.This issue affects Loginplus: from n/a through <= 1.2.
Product
Loginplus
Affected
up to 1.2
What to do
Affects up to 1.2. Update Loginplus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Quran Shortcode: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51625 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in edckwt Quran Shortcode quran-shortcode allows Blind SQL Injection.This issue affects Quran Shortcode: from n/a through <= 1.5.
Product
Quran Shortcode
Affected
up to 1.5
What to do
Affects up to 1.5. Update Quran Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Download-Mirror-Counter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51621 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reza19 Download-Mirror-Counter wp-download-mirror-counter allows SQL Injection.This issue affects Download-Mirror-Counter: from n/a through <= 1.1.
Product
Download-Mirror-Counter
Affected
up to 1.1
What to do
Affects up to 1.1. Update Download-Mirror-Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Porsline: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51620 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in porsline Porsline porsline allows Blind SQL Injection.This issue affects Porsline: from n/a through <= 1.0.2.
Product
Porsline
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Porsline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Market 360 Viewer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51619 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in market360 Market 360 Viewer market-360-viewer allows Blind SQL Injection.This issue affects Market 360 Viewer: from n/a through <= 1.01.
Product
Market 360 Viewer
Affected
up to 1.01
What to do
Affects up to 1.01. Update Market 360 Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Golf Tracker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51607 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in percent20 Golf Tracker golf-tracker allows SQL Injection.This issue affects Golf Tracker: from n/a through <= 0.7.
Product
Golf Tracker
Affected
up to 0.7
What to do
Affects up to 0.7. Update Golf Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Simple Job Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51602 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in oleksandr87 Simple Job Manager simple-job-manager allows SQL Injection.This issue affects Simple Job Manager: from n/a through <= 1.1.
Product
Simple Job Manager
Affected
up to 1.1
What to do
Affects up to 1.1. Update Simple Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Website price calculator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51601 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Maksym Marko Website price calculator price-calculator-to-your-website allows SQL Injection.This issue affects Website price calculator: from n/a through <= 4.1.
Product
Website price calculator
Affected
up to 4.1
What to do
Affects up to 4.1. Update Website price calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 20245 Stars Rating Funnel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51579 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.4.01.
Product
5 Stars Rating Funnel
Affected
up to 1.4.01
What to do
Affects up to 1.4.01. Update 5 Stars Rating Funnel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Easy Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51570 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in odihost Easy Gallery simple-gallery-odihost allows SQL Injection.This issue affects Easy Gallery: from n/a through <= 1.4.
Product
Easy Gallery
Affected
up to 1.4
What to do
Affects up to 1.4. Update Easy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024Category Ajax Filter: Local File InclusionCVE-2024-10871 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Category Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.2 via the 'params[caf-post-layout]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with a .php extension can be uploaded and included.
Product
Category Ajax Filter
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update Category Ajax Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 9, 2024Leopard - WordPress Offload Media: Unauthorized modification of data that can lead to privilege escalationCVE-2024-10589 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the import_settings() function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Leopard - WordPress Offload Media
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Leopard - WordPress Offload Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 9, 2024RegistrationMagic – User Registration Plugin with Custom Registration Forms: Privilege escalationCVE-2024-10508 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password reset token prior to updating a user's password. This makes it possible for unauthenticated attackers to reset the password of arbitrary users, including administrators, and gain access to these accounts.
Product
RegistrationMagic – User Registration Plugin with Custom Registration Forms
Affected
up to 6.0.2.6
What to do
Affects up to 6.0.2.6. Update RegistrationMagic – User Registration Plugin with Custom Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 9, 2024Poll Maker – Versus Polls, Anonymous Polls, Image Polls: Time-based SQL InjectionCVE-2024-9874 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Affected
up to 5.4.6
What to do
Affects up to 5.4.6. Update Poll Maker – Versus Polls, Anonymous Polls, Image Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Nov 9, 2024Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: Reflected Cross-Site ScriptingCVE-2024-10876 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.8.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 9, 2024Attesa Extra: Information ExposureCVE-2024-10688 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Attesa Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.2 via the 'attesa-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Attesa Extra
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Attesa Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Quform - WordPress Form Builder: Sensitive Information ExposureCVE-2024-8756 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Quform - WordPress Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the 'saveUploadedFile' function. This makes it possible for unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users. Files uploaded via forms created before version 2.21.0 will remain vulnerable to exposure after upgrading. To fully patch the plugin, site administrators should download any previously uploaded files, delete previously existing files and forms, and create the forms again after upgrading to version 2.21.0.
Product
Quform - WordPress Form Builder
Affected
up to 2.20.0
What to do
Affects up to 2.20.0. Update Quform - WordPress Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 9, 2024WPLMS Learning Management System for WordPress, WordPress LMS: Arbitrary file read and deletionCVE-2024-10470 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.
Product
WPLMS Learning Management System for WordPress, WordPress LMS
Affected
up to 4.962
What to do
Affects up to 4.962. Update WPLMS Learning Management System for WordPress, WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 9, 2024Envo Extra: Information ExposureCVE-2024-10770 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
Envo Extra
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update Envo Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Countdown Timer block – Display the event's date into a timer.: Information ExposureCVE-2024-10669 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the [ctb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Countdown Timer block – Display the event's date into a timer.
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Countdown Timer block – Display the event's date into a timer. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 9, 2024Content Slider Block: Information ExposureCVE-2024-10667 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Product
Content Slider Block
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Content Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 8, 2024SKT Addons for Elementor: Information ExposureCVE-2024-10693 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.3 via the Unfold widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Product
SKT Addons for Elementor
Affected
up to 3.3
What to do
Affects up to 3.3. Update SKT Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.