Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,660 results · page 348 of 494
Oct 22, 2024Rover IDX: Authentication BypassCVE-2024-10002 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation and capability check on the 'rover_idx_refresh_social_callback' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in to administrator. The vulnerability is partially patched in version 3.0.0.2905 and fully patched in version 3.0.0.2906.
- Product
- Rover IDX
- Affected
- up to 3.0.0.2905
- What to do
- Affects up to 3.0.0.2905. Update Rover IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 21, 2024Simple Custom Post Order: Missing AuthorizationCVE-2024-49321 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in colorlibplugins Simple Custom Post Order simple-custom-post-order allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Custom Post Order: from n/a through <= 2.5.7.
- Product
- Simple Custom Post Order
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update Simple Custom Post Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2024WP VR: Missing AuthorizationCVE-2024-49293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.4.
- Product
- WP VR
- Affected
- up to 8.5.4
- What to do
- Affects up to 8.5.4. Update WP VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2024ProfileGrid: Missing AuthorizationCVE-2024-49273 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities.This issue affects ProfileGrid : from n/a through <= 5.9.3.
- Product
- ProfileGrid
- Affected
- up to 5.9.3
- What to do
- Affects up to 5.9.3. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2024FunnelKit Automations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47328 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows SQL Injection.This issue affects FunnelKit Automations: from n/a through <= 3.1.2.
- Product
- FunnelKit Automations
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Photo Gallery Builder: Missing AuthorizationCVE-2024-49325 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdiscover Photo Gallery Builder photo-gallery-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Photo Gallery Builder: from n/a through <= 3.0.
- Product
- Photo Gallery Builder
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Photo Gallery Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024WP Content Copy Protection & No Right Click: Cross-Site Request Forgery (CSRF)CVE-2024-49306 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through <= 3.5.9.
- Product
- WP Content Copy Protection & No Right Click
- Affected
- up to 3.5.9
- What to do
- Affects up to 3.5.9. Update WP Content Copy Protection & No Right Click to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Endless Posts Navigation: Cross-Site Request Forgery (CSRF)CVE-2024-49629 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through <= 2.2.7.
- Product
- Endless Posts Navigation
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Endless Posts Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024FERMA.ru.net: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49620 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mrcheck116 FERMA.ru.net ferma-ru-net-checkout allows Blind SQL Injection.This issue affects FERMA.ru.net: from n/a through <= 1.3.3.
- Product
- FERMA.ru.net
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update FERMA.ru.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Social Link Groups: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49619 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acespritech Social Link Groups social-link-groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through <= 1.1.0.
- Product
- Social Link Groups
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Social Link Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024MyTweetLinks: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49618 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordan Lyall MyTweetLinks mytweetlinks allows Blind SQL Injection.This issue affects MyTweetLinks: from n/a through <= 1.1.1.
- Product
- MyTweetLinks
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update MyTweetLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Rate Own Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49616 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in nyasro Rate Own Post rate-own-post allows Blind SQL Injection.This issue affects Rate Own Post: from n/a through <= 1.0.
- Product
- Rate Own Post
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Rate Own Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024SermonAudio Widgets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49614 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SermonAudio SermonAudio Widgets sermonaudio-widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through <= 1.9.3.
- Product
- SermonAudio Widgets
- Affected
- up to 1.9.3
- What to do
- Affects up to 1.9.3. Update SermonAudio Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Simple Code Insert Shortcode: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49613 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in developersnote Simple Code Insert Shortcode simple-code-insert-shortcode allows SQL Injection.This issue affects Simple Code Insert Shortcode: from n/a through <= 1.0.
- Product
- Simple Code Insert Shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple Code Insert Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024SW Contact Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49612 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanjeev SW Contact Form sw-contact-form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through <= 1.0.
- Product
- SW Contact Form
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update SW Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Author Discussion: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49609 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion author-discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through <= 0.2.2.
- Product
- Author Discussion
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update Author Discussion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024MPG: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-47325 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects MPG: from n/a through <= 3.4.7.
- Product
- MPG
- Affected
- up to 3.4.7
- What to do
- Affects up to 3.4.7. Update MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024EU/UK VAT Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44061 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EU/UK VAT Manager for WooCommerce eu-vat-for-woocommerce.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through <= 2.12.14.
- Product
- EU/UK VAT Manager for WooCommerce
- Affected
- up to 2.12.14
- What to do
- Affects up to 2.12.14. Update EU/UK VAT Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024SiteBuilder Dynamic Components: Deserialization of Untrusted DataCVE-2024-49625 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in sphoid SiteBuilder Dynamic Components sitebuilder-dynamic-components allows Object Injection.This issue affects SiteBuilder Dynamic Components: from n/a through <= 1.0.
- Product
- SiteBuilder Dynamic Components
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update SiteBuilder Dynamic Components to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Advanced Advertising System: Deserialization of Untrusted DataCVE-2024-49624 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in smartdevth Advanced Advertising System advanced-advertising-system allows Object Injection.This issue affects Advanced Advertising System: from n/a through <= 1.3.1.
- Product
- Advanced Advertising System
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Advanced Advertising System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Duplicate Title Validate: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49623 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hasan movahed Duplicate Title Validate duplicate-title-validate allows Blind SQL Injection.This issue affects Duplicate Title Validate: from n/a through <= 1.0.
- Product
- Duplicate Title Validate
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Duplicate Title Validate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Giveaway Boost: Deserialization of Untrusted DataCVE-2024-49332 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.
- Product
- Giveaway Boost
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Giveaway Boost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Easy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49631 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abdul Kader Easy Addons for Elementor easy-addons-for-elementor allows Stored XSS.This issue affects Easy Addons for Elementor: from n/a through <= 1.5.0.
- Product
- Easy Addons for Elementor
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Easy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024WP Education: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49630 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems WP Education wp-education allows Stored XSS.This issue affects WP Education: from n/a through <= 1.2.8.
- Product
- WP Education
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update WP Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Shipyaari Shipping Management: Deserialization of Untrusted DataCVE-2024-49626 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Piyush Patel Shipyaari Shipping Management shipyaari-shipping-managment allows Object Injection.This issue affects Shipyaari Shipping Management: from n/a through <= 1.2.
- Product
- Shipyaari Shipping Management
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Shipyaari Shipping Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Google Map Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49606 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Google Map Locations google-map-locations allows Reflected XSS.This issue affects Google Map Locations: from n/a through <= 1.0.
- Product
- Google Map Locations
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Google Map Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Simple User Registration: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49604 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through <= 6.7.
- Product
- Simple User Registration
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024jLayer Parallax Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49334 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unizoe Web Solutions jLayer Parallax Slider jlayer-parallax-slider-wp allows Reflected XSS.This issue affects jLayer Parallax Slider: from n/a through <= 1.0.
- Product
- jLayer Parallax Slider
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update jLayer Parallax Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024WP REST API FNS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49328 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through <= 1.0.0.
- Product
- WP REST API FNS
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP REST API FNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024All in One Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49323 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahriar Alam All in One Slider all-in-one-slider allows Reflected XSS.This issue affects All in One Slider: from n/a through <= 1.1.
- Product
- All in One Slider
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update All in One Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024SSV Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49286 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV Events ssv-events allows PHP Local File Inclusion.This issue affects SSV Events: from n/a through <= 3.2.7.
- Product
- SSV Events
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update SSV Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Mighty Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-48049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mighty Plugins Mighty Builder mighty-builder allows Stored XSS.This issue affects Mighty Builder: from n/a through <= 1.0.2.
- Product
- Mighty Builder
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Mighty Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 19, 2024StreamWeasels Twitch Integration: Stored Cross-Site ScriptingCVE-2024-9897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-twitch-embed shortcode in all versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- StreamWeasels Twitch Integration
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update StreamWeasels Twitch Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 19, 2024ElementInvader Addons for Elementor: Sensitive Information ExposureCVE-2024-9889 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.9 via the Page Loader widget. This makes it possible for authenticated attackers, with contributor-level access and above, to view private/draft/password protected posts, pages, and Elementor templates that they should not have access to.
- Product
- ElementInvader Addons for Elementor
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 19, 2024Photo Gallery Slideshow & Masonry Tiled Gallery: SQL InjectionCVE-2019-25218 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Photo Gallery Slideshow & Masonry Tiled Gallery
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Photo Gallery Slideshow & Masonry Tiled Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 18, 2024The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) aCVE-2024-9593 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 18, 2024Movie Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43300 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bert Movie Database movie-database allows Stored XSS.This issue affects Movie Database: from n/a through <= 1.0.11.
- Product
- Movie Database
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Movie Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Dynamic Elementor Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-49243 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ramjon27 Dynamic Elementor Addons dynamic-elementor-addons allows PHP Local File Inclusion.This issue affects Dynamic Elementor Addons: from n/a through <= 1.0.0.
- Product
- Dynamic Elementor Addons
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dynamic Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Tito: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49241 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tady Tito tito allows DOM-Based XSS.This issue affects Tito: from n/a through <= 2.3.
- Product
- Tito
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Tito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024AB Categories Search Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49240 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajberasategui AB Categories Search Widget ab-categories-search-widget allows Reflected XSS.This issue affects AB Categories Search Widget : from n/a through <= 0.2.5.
- Product
- AB Categories Search Widget
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update AB Categories Search Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Add Categories Post Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49239 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nikhilvaghela Add Categories Post Footer add-categories-post-footer allows Reflected XSS.This issue affects Add Categories Post Footer: from n/a through <= 2.2.2.
- Product
- Add Categories Post Footer
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Add Categories Post Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024ADIF Log Search Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emka73 ADIF Log Search Widget adif-log-search-widget allows Reflected XSS.This issue affects ADIF Log Search Widget: from n/a through <= 1.0f.
- Product
- ADIF Log Search Widget
- Affected
- up to 1.0f
- What to do
- Affects up to 1.0f. Update ADIF Log Search Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Crazy Call To Action Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49236 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-action-box allows DOM-Based XSS.This issue affects Crazy Call To Action Box: from n/a through <= 1.0.5.
- Product
- Crazy Call To Action Box
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Crazy Call To Action Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Plexx Elementor Extension: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeworm Plexx Elementor Extension plexx-elementor-extension allows DOM-Based XSS.This issue affects Plexx Elementor Extension: from n/a through <= 1.3.6.
- Product
- Plexx Elementor Extension
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Plexx Elementor Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024MAS Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49233 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MadrasThemes MAS Elementor mas-addons-for-elementor allows DOM-Based XSS.This issue affects MAS Elementor: from n/a through <= 1.1.6.
- Product
- MAS Elementor
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update MAS Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024El mejor Cluster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49232 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in derethor El mejor Cluster mejorcluster allows DOM-Based XSS.This issue affects El mejor Cluster: from n/a through <= 1.1.15.
- Product
- El mejor Cluster
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update El mejor Cluster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024WordPress Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49231 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cyclop WordPress Video wordpress-video allows Stored XSS.This issue affects WordPress Video: from n/a through <= 1.0.
- Product
- WordPress Video
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WordPress Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Ajax Custom CSS/JS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49230 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harry005 Ajax Custom CSS/JS ajax-awesome-css allows Reflected XSS.This issue affects Ajax Custom CSS/JS: from n/a through <= 2.0.4.
- Product
- Ajax Custom CSS/JS
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Ajax Custom CSS/JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024bVerse Convert: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49228 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edwin Rivera bVerse Convert bverse-convert allows Stored XSS.This issue affects bVerse Convert: from n/a through <= 1.3.7.1.
- Product
- bVerse Convert
- Affected
- up to 1.3.7.1
- What to do
- Affects up to 1.3.7.1. Update bVerse Convert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024wpPricing Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49225 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in swebdeveloper wpPricing Builder wppricing-builder-lite-responsive-pricing-table-builder allows Stored XSS.This issue affects wpPricing Builder: from n/a through <= 1.5.0.
- Product
- wpPricing Builder
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update wpPricing Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.