Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

572new WordPress flaws this week

398,071entries in the database

24,660 results · page 351 of 494

Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized data modificationCVE-2023-7294 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the create_mollie_profile function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to create a mollie payment profile.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized access of dataCVE-2023-7293 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_mollie_account_details function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to verify the existence of a mollie account.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized notification dismissalCVE-2023-7292 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized notification dismissal due to a missing capability check on the paytium_notice_dismiss function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to dismiss admin notices.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized modification of dataCVE-2023-7291 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_mollie_account function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to set up a mollie account.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized access of dataCVE-2023-7290 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_for_verified_profiles function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to check profile statuses.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized API key updateCVE-2023-7289 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytium_sw_save_api_keys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin API keys.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized data modificationCVE-2023-7288 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_profile_preference function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin settings.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized subscription cancellationCVE-2023-7287 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on the pt_cancel_subscription function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to cancel a subscription to the plugin.
Product
Paytium: Mollie payment forms & donations
Affected
up to 4.3.7
What to do
Affects up to 4.3.7. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to mCVE-2022-4974 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record freemius.com web.archive.org
Oct 16, 2024WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress CVE-2022-4973 · WordPress plugins & themes · reported by WordfenceMedium 4.9
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org wordpress.org
Oct 16, 2024Download Monitor: Authorization bypassCVE-2022-4972 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
Product
Download Monitor
Affected
up to 4.7.51
What to do
Affects up to 4.7.51. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024NinjaFirewall: Authenticated PHAR DeserializationCVE-2021-4451 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall).
Product
NinjaFirewall
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update NinjaFirewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Oct 16, 2024Post Grid: Blind SQL InjectionCVE-2021-4450 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Post Grid
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Kaswara Modern VC Addons: Authorization bypassCVE-2021-4448 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.
Product
Kaswara Modern VC Addons
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Kaswara Modern VC Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 16, 2024Essential Addons for Elementor: Privilege escalationCVE-2021-4447 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user.
Product
Essential Addons for Elementor
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Essential Addons for Elementor: Authorization bypassCVE-2021-4446 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins.
Product
Essential Addons for Elementor
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Premium Addons for Elementor: Arbitrary Option UpdatesCVE-2021-4445 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.
Product
Premium Addons for Elementor
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ithemes.com plugins.trac.wordpress.org
Oct 16, 2024Product Filter by WooBeWoo: Authorization bypassCVE-2021-4444 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization checks on various functions. This makes it possible for unauthenticated attackers to perform unauthorized actions such as creating new filters and injecting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery.
Product
Product Filter by WooBeWoo
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Product Filter by WooBeWoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024WordPress Mega Menu: Arbitrary File CreationCVE-2021-4443 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compiler_save AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code.
Product
WordPress Mega Menu
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update WordPress Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sh3llcon.org acunetix.com
Oct 16, 2024Facebook Chat: Authorization bypassCVE-2020-36838 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites.
Product
Facebook Chat
Affected
up to 1.5
What to do
Affects up to 1.5. Update Facebook Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Oct 16, 2024ThemeGrill Demo Importer: Authentication bypassCVE-2020-36837 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there is a user named 'admin', the attacker will become automatically logged in as an administrator.
Product
ThemeGrill Demo Importer
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update ThemeGrill Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record raw.githubusercontent.com openwall.com
Oct 16, 2024WP Fastest Cache: Unauthorized arbitrary file deletionCVE-2020-36836 · WordPress plugins & themes · reported by WordfenceHigh 8
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.
Product
WP Fastest Cache
Affected
up to 0.9.0.2
What to do
Affects up to 0.9.0.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wearetradecraft.com
Oct 16, 2024Migration, Backup, Staging – WPvivid: Sensitive information disclosure of a WordPress site's databaseCVE-2020-36835 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing capability checks on the wp_ajax_wpvivid_add_remote AJAX action that allows low-level authenticated attackers to send back-ups to a remote location of their choice for review. This affects versions up to, and including 0.9.35.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.35
What to do
Affects up to 0.9.35. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org webarxsecurity.com
Oct 16, 2024Discount Rules for WooCommerce: Missing authorizationCVE-2020-36834 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying rules and saving configurations.
Product
Discount Rules for WooCommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Discount Rules for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordfence.com
Oct 16, 2024Indeed Membership Pro: Authorization bypassCVE-2020-36833 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions such as modifying settings and viewing sensitive data.
Product
Indeed Membership Pro
Affected
7.3 to 8.6
What to do
Affects 7.3 to 8.6. Update Indeed Membership Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
Oct 16, 2024Ultimate Membership Pro: Authentication BypassCVE-2020-36832 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user ID.
Product
Ultimate Membership Pro
What to do
Update Ultimate Membership Pro to the newest version.
Full record and what to do →NVD record codecanyon.net wpscan.com
Oct 16, 2024NextScripts: Social Networks Auto-Poster: Authorization bypassCVE-2020-36831 · WordPress plugins & themes · reported by WordfenceMedium 5
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged attackers, like subscribers, to perform restricted actions that would be otherwise locked to a administrative-level user.
Product
NextScripts: Social Networks Auto-Poster
Affected
up to 4.3.17
What to do
Affects up to 4.3.17. Update NextScripts: Social Networks Auto-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.sucuri.net wpscan.com
Oct 16, 2024SiteGround Optimizer: Authorization bypass leading to Remote Code Execution and Local File InclusionCVE-2019-25217 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switch_php function called via the /switch-php REST API route. This allows attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
SiteGround Optimizer
Affected
up to 5.0.12
What to do
Affects up to 5.0.12. Update SiteGround Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.sucuri.net wordfence.com
Oct 16, 2024ARI-Adminer: Authorization bypassCVE-2019-25215 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes.
Product
ARI-Adminer
Affected
up to 1.1.14
What to do
Affects up to 1.1.14. Update ARI-Adminer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024ShopWP: Authorization bypassCVE-2019-25214 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating the plugin's settings and injecting malicious scripts.
Product
ShopWP
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update ShopWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024File Manager: Authorization bypassCVE-2018-25105 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files that can be used for remote code execution.
Product
File Manager
Affected
up to 3.0
What to do
Affects up to 3.0. Update File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024Kento Post View Counter: SQL InjectionCVE-2016-15040 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kento_pvc_geo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Kento Post View Counter
Affected
up to 2.8
What to do
Affects up to 2.8. Update Kento Post View Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2024The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively.CVE-2012-10018 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.
Affected
up to 6.1
What to do
Affects up to 6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 16, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App: Stored Cross-Site ScriptingCVE-2024-9873 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in posts, comments, and profiles when Markdown support is enabled in all versions up to, and including, 6.4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App
Affected
up to 6.4.6.1
What to do
Affects up to 6.4.6.1. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2024Multiline files upload for contact form 7: Unauthorized plugin deactivationCVE-2024-9891 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the mfcf7_zl_custom_handle_deactivation_plugin_form_submission() function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin and send a custom reason from the site.
Product
Multiline files upload for contact form 7
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Multiline files upload for contact form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-9634 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the give_company_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.16.3
What to do
Affects up to 3.16.3. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024AppPresser – Mobile App Framework: Privilege escalationCVE-2024-9305 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
Product
AppPresser – Mobile App Framework
Affected
up to 4.4.4
What to do
Affects up to 4.4.4. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024UltimateAI: Authentication bypassCVE-2024-9105 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.8.3. This is due to insufficient verification on the user being supplied in the 'ultimate_ai_register_or_login_with_google' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
UltimateAI
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update UltimateAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 15, 2024UltimateAI: Authentication bypassCVE-2024-9104 · WordPress plugins & themes · reported by WordfenceMedium 5.6
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimate_ai_change_pass' function. This makes it possible for unauthenticated attackers to reset the password of the first user, whose account is not yet activated or the first user who activated their account, who are subscribers.
Product
UltimateAI
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update UltimateAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 15, 2024The AADMY – Add Auto Date Month Year Into Posts: Arbitrary shortcode executionCVE-2024-9837 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The AADMY – Add Auto Date Month Year Into Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The AADMY – Add Auto Date Month Year Into Posts
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update The AADMY – Add Auto Date Month Year Into Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2024WooCommerce: HTML InjectionCVE-2024-9944 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions.
Product
WooCommerce
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 14, 2024WP 2FA with Telegram: Two-Factor Authentication BypassCVE-2024-9820 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.
Product
WP 2FA with Telegram
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP 2FA with Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2024WP 2FA with Telegram: Authentication BypassCVE-2024-9687 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.
Product
WP 2FA with Telegram
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP 2FA with Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2024Elementor Website Builder – More than Just a Page Builder: Basic Information ExposureCVE-2024-6757 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the get_image_alt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract either excerpt data or titles of private or password-protected posts.
Product
Elementor Website Builder – More than Just a Page Builder
Affected
up to 3.23.5
What to do
Affects up to 3.23.5. Update Elementor Website Builder – More than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2024Elementor Addon Elements: Sensitive Information ExposureCVE-2024-8902 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_column function in modules/data-table/widgets/data-table.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
Product
Elementor Addon Elements
Affected
up to 1.13.8
What to do
Affects up to 1.13.8. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2024The WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration ForCVE-2024-8757 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the linked_user_id parameter in all versions up to, and including, 3.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 12, 2024Stackable – Page Builder Gutenberg Blocks: CSS InjectionCVE-2024-8760 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don't perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users.
Product
Stackable – Page Builder Gutenberg Blocks
Affected
up to 3.13.6
What to do
Affects up to 3.13.6. Update Stackable – Page Builder Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2024ImagePress – Image Gallery: Unauthorized modification and loss of dataCVE-2024-9824 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ip_delete_post' and 'ip_update_post_title' functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts and update post titles.
Product
ImagePress – Image Gallery
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update ImagePress – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2024Bridge Core: Unauthorized modification of data or loss of dataCVE-2024-9860 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'import_action' and 'install_plugin_per_demo' functions in versions up to, and including, 3.3. This makes it possible for authenticated attackers with subscriber-level permissions or above, to delete or change plugin settings, import demo data, and install limited plugins.
Product
Bridge Core
Affected
up to 3.3
What to do
Affects up to 3.3. Update Bridge Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 11, 2024Bot for Telegram on WooCommerce: Sensitive information disclosureCVE-2024-9821 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcfto_get_settings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the Telegram Bot Token, a secret token used to control the bot, which can then be used to log in as any existing user on the site, such as an administrator, if they know the username, due to the Login with Telegram feature.
Product
Bot for Telegram on WooCommerce
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Bot for Telegram on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.