Updated 16 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

5,764 results · page 35 of 116

May 14, 2024Pure Chat – Live Chat Plugin & More!: Stored Cross-Site ScriptingCVE-2024-3595 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pure Chat – Live Chat Plugin & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the purechatwid and purechatwname parameter in all versions up to, and including, 2.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pure Chat – Live Chat Plugin & More!
Affected
up to 2.22
What to do
Affects up to 2.22. Update Pure Chat – Live Chat Plugin & More! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 14, 2024Last Viewed Posts by WPBeginner: PHP Object InjectionCVE-2024-3070 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input from the LastViewedPosts Cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Last Viewed Posts by WPBeginner
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Last Viewed Posts by WPBeginner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024AI Engine: ChatGPT Chatbot: Unrestricted Upload of File with Dangerous TypeCVE-2024-34440 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.2.63.
Product
AI Engine: ChatGPT Chatbot
Affected
up to 2.2.63
What to do
Affects up to 2.2.63. Update AI Engine: ChatGPT Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Forty Four – 404 Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34423 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phpbits Forty Four – 404 Plugin for WordPress allows Stored XSS.This issue affects Forty Four – 404 Plugin for WordPress: from n/a through 1.4.
Product
Forty Four – 404 Plugin for
Affected
up to 1.4
What to do
Affects up to 1.4. Update Forty Four – 404 Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Configure Login Timeout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34419 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nathan Vonnahme Configure Login Timeout allows Stored XSS.This issue affects Configure Login Timeout: from n/a through 1.0.
Product
Configure Login Timeout
Affected
up to 1.0
What to do
Affects up to 1.0. Update Configure Login Timeout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permittingCVE-2024-2749 · WordPress plugins & themes · reported by WPScanMedium 5.9
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations.
Fixed in
1.6.8
What to do
Update the plugin to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024VikBooking Hotel Booking Engine & PMS: Allows direct access to menusCVE-2024-2441 · WordPress plugins & themes · reported by WPScanHigh 8.1
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.
Product
VikBooking Hotel Booking Engine & PMS
Fixed in
1.6.8
What to do
Update VikBooking Hotel Booking Engine & PMS to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Save as PDF Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2023-5971 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Save as PDF Plugin by Pdfcrowd
Fixed in
3.2.0
What to do
Update Save as PDF Plugin by Pdfcrowd to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2024Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability.CVE-2024-32674 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.
Fixed in
1.1.32
What to do
Update the plugin to 1.1.32 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 6, 2024Login with phone number: Missing AuthorizationCVE-2024-34371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.18.
Product
Login with phone number
Affected
up to 1.7.18
What to do
Affects up to 1.7.18. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024AJAX Login and Registration modal popup + inline form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33918 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maxim K AJAX Login and Registration modal popup + inline form allows Stored XSS.This issue affects AJAX Login and Registration modal popup + inline form: from n/a through 2.23.
Product
AJAX Login and Registration modal popup + inline form
Affected
up to 2.23
What to do
Affects up to 2.23. Update AJAX Login and Registration modal popup + inline form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2024Login Logout Register Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vinod Dalvi Login Logout Register Menu allows Stored XSS.This issue affects Login Logout Register Menu: from n/a through 2.0.
Product
Login Logout Register Menu
Affected
up to 2.0
What to do
Affects up to 2.0. Update Login Logout Register Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: Open RedirectCVE-2024-4133 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.0.30. This is due to insufficient validation on the redirect url supplied via the redirect_to parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Affected
up to 4.0.30
What to do
Affects up to 4.0.30. Update ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WordPress Header Builder Plugin – Pearl: Stored Cross-Site ScriptingCVE-2024-4000 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_hb' shortcode in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Header Builder Plugin – Pearl
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update WordPress Header Builder Plugin – Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Unauthorized access, modification, and loss of dataCVE-2024-3942 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.
Product
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update MasterStudy LMS WordPress Plugin – for Online Courses and Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic: Stored Cross-Site ScriptingCVE-2024-3554 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2024-3550 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Affected
up to 7.1.2
What to do
Affects up to 7.1.2. Update WP Shortcodes Plugin — Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Unauthorized loss of dataCVE-2024-3295 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the profile_pic_remove function in versions up to, and including, 3.1.5. This makes it possible for unauthenticated attackers to delete any media file.
Product
User Registration – Custom Registration Form, Login Form, and User Profile
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update User Registration – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor: Stored Cross-Site ScriptingCVE-2024-2967 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 2, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-2867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 4.15.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.15.4
What to do
Affects up to 4.15.4. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024MailerLite – Signup forms (official): Unauthorized plugin setting changesCVE-2024-2797 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized plugin setting changes due to a missing capability check on the toggleRolesAndPermissions and editAllowedRolesAndPermissions functions in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to allow lower level users to modify forms.
Product
MailerLite – Signup forms (official)
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update MailerLite – Signup forms (official) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2024-2765 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Skype and Spotify URL parameters in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.8.4
What to do
Affects up to 2.8.4. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
May 2, 2024InstaWP Connect – 1-click WP Staging & Migration: Arbitrary file uploadsCVE-2024-2667 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.22
What to do
Affects up to 0.1.0.22. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024User Registration – Custom Registration Form, Login Form, and User Profile: Privilege escalationCVE-2024-2417 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the form_save_action() function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the registration form and make the default registration role administrator. This subsequently allows the attacker to register an account as an administrator on the site.
Product
User Registration – Custom Registration Form, Login Form, and User Profile
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update User Registration – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 2, 2024Social Sharing Plugin – Social Warfare: Stored Cross-Site ScriptingCVE-2024-1959 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Sharing Plugin – Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialWarfare' shortcode in all versions up to, and including, 4.4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Sharing Plugin – Social Warfare
Affected
up to 4.4.6.1
What to do
Affects up to 4.4.6.1. Update Social Sharing Plugin – Social Warfare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2024Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder: Unauthorized loss of dataCVE-2024-1945 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'arflite_remove_preview_data' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary site options, resulting in loss of availability.
Product
Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More: Sensitive Information ExposureCVE-2024-0615 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0 via the API. This makes it possible for unauthenticated attackers to extract post titles, IDs, slugs, statuses and other information including post content. This includes published content only.
Product
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 29, 2024Knowledge Base documentation & wiki plugin – BasePress: Missing AuthorizationCVE-2024-33588 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
Product
Knowledge Base documentation & wiki plugin – BasePress
Affected
up to 2.16.1
What to do
Affects up to 2.16.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Knowledge Base documentation & wiki plugin – BasePress: Server-Side Request Forgery (SSRF)CVE-2024-33590 · WordPress plugins & themes · reported by PatchstackMedium 5
Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
Product
Knowledge Base documentation & wiki plugin – BasePress
Affected
up to 2.16.1
What to do
Affects up to 2.16.1. Update Knowledge Base documentation & wiki plugin – BasePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024Save as PDF plugin by Pdfcrowd: Missing AuthorizationCVE-2024-33684 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.0.
Product
Save as PDF plugin by Pdfcrowd
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Save as PDF plugin by Pdfcrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 29, 2024The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requCVE-2024-2505 · WordPress plugins & themes · reported by WPScanHigh 8.1
The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend access to lower privileged users, like Subscribers, despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical GamiPress WordPress plugin before 6.8.9 configurations.
Fixed in
6.8.9
What to do
Update the plugin to 6.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions uCVE-2024-3682 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wp-staging.com
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Fixed in
7.1.0
What to do
Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2024LoginPress Pro: Improper Restriction of Excessive Authentication AttemptsCVE-2024-32676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Login as User or Customer (User Switching): Improper AuthenticationCVE-2023-51484 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Customer (User Switching): from n/a through 3.8.
Product
Login as User or Customer (User Switching)
Affected
up to 3.8
What to do
Affects up to 3.8. Update Login as User or Customer (User Switching) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024Eazy Plugin Manager: Improper AuthenticationCVE-2023-51482 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Authentication vulnerability in EazyPlugins Eazy Plugin Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eazy Plugin Manager: from n/a through 4.1.2.
Product
Eazy Plugin Manager
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Eazy Plugin Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2024The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress isCVE-2024-3988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Fancy Text Widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2024LoginPress Pro: Missing AuthorizationCVE-2024-32677 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LoginPress LoginPress Pro.This issue affects LoginPress Pro: from n/a before 3.0.0.
Product
LoginPress Pro
Fixed in
3.0.0
What to do
Update LoginPress Pro to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Import WP: Does not prevent users with the administrator role from pinging conducting SSRF attacksCVE-2023-7253 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
Product
Import WP
Fixed in
2.13.1
What to do
Update Import WP to 2.13.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 23, 2024GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: Stored Cross-Site ScriptingCVE-2024-3732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gd_single_tabs' shortcode in all versions up to, and including, 2.3.48 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GeoDirectory – WordPress Business Directory Plugin, or Classified Directory
Affected
up to 2.3.48
What to do
Affects up to 2.3.48. Update GeoDirectory – WordPress Business Directory Plugin, or Classified Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 21, 2024A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress.CVE-2015-10132 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin.php. The manipulation of the argument Spreadplugin leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.8.6.6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-261676.
Affected
up to 3.8.6.1
What to do
Affects up to 3.8.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Apr 18, 2024VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VikBooking Hotel Booking Engine & PMS allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.6.7.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 18, 2024The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordCVE-2024-1429 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tab_link’ attribute of the Panel Slider widget in all versions up to, and including, 5.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32572 is likely a duplicate of this or CVE-2024-1426.
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2024The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordCVE-2024-1426 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ attribute of the Price List widget in all versions up to, and including, 5.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 17, 2024RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Blind Server-Side Request ForgeryCVE-2023-6805 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetch_feed functionality. This makes it possible for authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to modify information from internal services. NOTE: This vulnerability, exploitable by contributor-level users, was was fixed in version 4.4.7. The same vulnerability was fixed for author-level users in version 4.4.8.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 4.4.7
Fixed in
4.4.7
What to do
Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to 4.4.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 17, 2024Theme My Login: Missing AuthorizationCVE-2024-32525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6.
Product
Theme My Login
Affected
up to 7.1.6
What to do
Affects up to 7.1.6. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro: Does not sanitise and escape some of its settingsCVE-2024-2309 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro
Fixed in
3.4.0
What to do
Update WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro to 3.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2024coreActivity: Activity Logging plugin for: Retrieved IP addresses of requests via headers such X-FORWARDED to log themCVE-2024-0868 · WordPress plugins & themes · reported by WPScanMedium 5.3
The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value
Product
coreActivity: Activity Logging plugin for
Fixed in
2.1
What to do
Update coreActivity: Activity Logging plugin for to 2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Login With Ajax: Cross-Site Request Forgery (CSRF)CVE-2024-30546 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Login With Ajax.This issue affects Login With Ajax: from n/a through 4.1.
Product
Login With Ajax
Affected
up to 4.1
What to do
Affects up to 4.1. Update Login With Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Feather Login Page: Cross-Site Request Forgery (CSRF)CVE-2024-31923 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page.This issue affects Feather Login Page: from n/a through 1.1.5.
Product
Feather Login Page
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.