Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

38added in the last 30 days

589new WordPress flaws this week

398,319entries in the database

24,673 results · page 360 of 494

Aug 29, 2024ListingPro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-39620 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.
Product
ListingPro
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024ListingPro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38795 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.
Product
ListingPro
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Best Restaurant Menu by PriceListo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38793 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PriceListo Best Restaurant Menu by PriceListo allows SQL Injection.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.4.1.
Product
Best Restaurant Menu by PriceListo
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Best Restaurant Menu by PriceListo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Easy Digital Downloads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-5057 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.
Product
Easy Digital Downloads
Affected
up to 3.2.12
What to do
Affects up to 3.2.12. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024WP User Frontend: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38693 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7.
Product
WP User Frontend
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Premium SEO Pack – WP SEO: Sensitive Information ExposureCVE-2024-3679 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.002. This makes it possible for unauthenticated attackers to view limited information from password protected posts through the social meta data.
Product
Premium SEO Pack – WP SEO
Affected
up to 1.6.002
What to do
Affects up to 1.6.002. Update Premium SEO Pack – WP SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 29, 2024Popup Builder: Sensitive Information ExposureCVE-2024-2541 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the Subscribers Import feature. This makes it possible for unauthenticated attackers to extract sensitive data after an administrator has imported subscribers via a CSV file. This data may include the first name, last name, e-mail address, and potentially other personally identifiable information of subscribers.
Product
Popup Builder
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar: Unauthorized arbitrary file deletionCVE-2024-7856 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles() function and insufficient path validation on the 'file' parameter in all versions up to, and including, 5.7.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files which can make remote code execution possible when wp-config.php is deleted.
Product
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Affected
up to 5.7.0.1
What to do
Affects up to 5.7.0.1. Update MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024Front End Users: Time-based SQL InjectionCVE-2024-7607 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Front End Users
Affected
up to 3.2.28
What to do
Affects up to 3.2.28. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid: Sensitive Information ExposureCVE-2024-7418 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.7.11 via the post_query_guten and post_query functions. This makes it possible for authenticated attackers, with contributor-level access and above, to extract information from posts that are not public (i.e. draft, future, etc..).
Product
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Affected
up to 7.7.11
What to do
Affects up to 7.7.11. Update The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 29, 2024GiveWP – Donation Plugin and Fundraising Platform: Full Path DisclosureCVE-2024-6551 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.15.1
What to do
Affects up to 3.15.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2024WP Accessibility Helper (WAH): Unauthorized modification of dataCVE-2024-5987 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_contrast_variations' and 'save_empty_contrast_variations' functions in all versions up to, and including, 0.6.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit or delete contrast settings. Please note these issues were patched in 0.6.2.8, though it broke functionality and the vendor has not responded to our follow-ups.
Product
WP Accessibility Helper (WAH)
Affected
up to 0.6.2.8
What to do
Affects up to 0.6.2.8. Update WP Accessibility Helper (WAH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2024Gutentor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-5417 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutentor
Fixed in
3.3.6
What to do
Update Gutentor to 3.3.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2024MagePeople Team Taxi Booking Manager for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43986 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagePeople Team Taxi Booking Manager for WooCommerce allows Stored XSS.This issue affects Taxi Booking Manager for WooCommerce: through 1.0.9.
Product
MagePeople Team Taxi Booking Manager for WooCommerce
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update MagePeople Team Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Theme Editor: Deserialization of untrusted inputCVE-2022-2440 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Product
Theme Editor
Affected
up to 2.8
What to do
Affects up to 2.8. Update Theme Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2024Media Library Folders: Second order SQL InjectionCVE-2024-7857 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_sort_type' AJAX action in all versions up to, and including, 8.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Media Library Folders
Affected
up to 8.2.2
What to do
Affects up to 8.2.2. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2024Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free: Unauthorized modification of dataCVE-2024-7447 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'fnsf_af2_handel_file_upload' function in all versions up to, and including, 3.7.3.2. This makes it possible for unauthenticated attackers to upload arbitrary media to the site, even if no forms exist.
Product
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free
Affected
up to 3.7.3.2
What to do
Affects up to 3.7.3.2. Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2024Funnelforms Free: Arbitrary file deletionCVE-2024-6312 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' function. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
Product
Funnelforms Free
Affected
up to 3.7.3.2
What to do
Affects up to 3.7.3.2. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2024Mollie Payments for WooCommerce: Information exposureCVE-2024-6448 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the error reporting being enabled by default in multiple plugin files. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
Product
Mollie Payments for WooCommerce
Affected
up to 7.7.0
What to do
Affects up to 7.7.0. Update Mollie Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Relevanssi Live Ajax Search: Argument injectionCVE-2024-7573 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject arbitrary arguments into a WP_Query query and potentially expose sensitive information such as attachments or private posts.
Product
Relevanssi Live Ajax Search
Affected
up to 2.4
What to do
Affects up to 2.4. Update Relevanssi Live Ajax Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 27, 2024Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More: Unauthorized modification of dataCVE-2024-8199 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_api_key' function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update API Key options.
Product
Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2024Oxygen Builder: Unauthorized modification of dataCVE-2024-6688 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update stylesheets.
Product
Oxygen Builder
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update Oxygen Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record oxygenbuilder.com wordfence.com
Aug 26, 2024Zephyr Project Manager: Authorization Bypass Through User-Controlled KeyCVE-2024-43916 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.102.
Product
Zephyr Project Manager
Affected
up to 3.3.102
What to do
Affects up to 3.3.102. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Zephyr Project Manager: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43915 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through .3.102.
Product
Zephyr Project Manager
Fixed in
3.3.103
What to do
Update Zephyr Project Manager to 3.3.103 or newer.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Advanced Form Integration: Cross-Site Request Forgery (CSRF)CVE-2024-43340 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4.
Product
Advanced Form Integration
Affected
up to 1.89.4
What to do
Affects up to 1.89.4. Update Advanced Form Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Create by Mediavine: Insertion of Sensitive Information Into Sent DataCVE-2024-43264 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through <= 1.9.8.
Product
Create by Mediavine
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Create by Mediavine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Order Export for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2024-43259 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue affects Order Export for WooCommerce: from n/a through <= 3.23.
Product
Order Export for WooCommerce
Affected
up to 3.23
What to do
Affects up to 3.23. Update Order Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Store Locator Plus: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17.01.
Product
Store Locator Plus
Affected
up to 2311.17.01
What to do
Affects up to 2311.17.01. Update Store Locator Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Leopard - WordPress offload media: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.
Product
Leopard - WordPress offload media
Affected
up to 2.0.36
What to do
Affects up to 2.0.36. Update Leopard - WordPress offload media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024MyBookTable Bookstore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43255 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable.This issue affects MyBookTable Bookstore: from n/a through <= 3.3.9.
Product
MyBookTable Bookstore
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update MyBookTable Bookstore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Bit Form Pro: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43251 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bit Apps Bit Form Pro.This issue affects Bit Form Pro: from n/a through 2.6.4.
Product
Bit Form Pro
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Bit Form Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Shared Files: Insertion of Sensitive Information Into Sent DataCVE-2024-43230 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.28.
Product
Shared Files
Affected
up to 1.7.28
What to do
Affects up to 1.7.28. Update Shared Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024myCred: Missing AuthorizationCVE-2024-43214 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.
Product
myCred
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-39657 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.18.
Product
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
Affected
up to 2.6.18
What to do
Affects up to 2.6.18. Update Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024WP Testimonial Widget: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43967 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Stark Digital WP Testimonial Widget allows Stored XSS.This issue affects WP Testimonial Widget: from n/a through 3.1.
Product
WP Testimonial Widget
Affected
up to 3.1
What to do
Affects up to 3.1. Update WP Testimonial Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Flash & HTML5 Video: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43319 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31.
Product
Flash & HTML5 Video
Affected
up to 2.5.31
What to do
Affects up to 2.5.31. Update Flash & HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024wpForo Forum: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-43289 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.
Product
wpForo Forum
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Contest Gallery: Insertion of Sensitive Information Into Sent DataCVE-2024-43283 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2.
Product
Contest Gallery
Affected
up to 23.1.2
What to do
Affects up to 23.1.2. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024WP Testimonial Widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43966 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stark Digital WP Testimonial Widget.This issue affects WP Testimonial Widget: from n/a through 3.1.
Product
WP Testimonial Widget
Affected
up to 3.1
What to do
Affects up to 3.1. Update WP Testimonial Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2024Image Hotspot by DevVN: PHP Object InjectionCVE-2024-7656 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deserialization of untrusted input in the 'devvn_ihotspot_shortcode_func' function. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Image Hotspot by DevVN
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Image Hotspot by DevVN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2024Simple Job Board: PHP Object InjectionCVE-2024-7351 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Simple Job Board
Affected
up to 2.12.3
What to do
Affects up to 2.12.3. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 24, 2024WordPress Button Plugin MaxButtons: Information exposureCVE-2024-6499 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
Product
WordPress Button Plugin MaxButtons
Affected
up to 9.7.8
What to do
Affects up to 9.7.8. Update WordPress Button Plugin MaxButtons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 23, 2024ImageRecycle pdf & image compression: Cross-Site Request ForgeryCVE-2024-8120 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This makes it possible for unauthenticated attackers to update plugin settings along with performing other actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2024ImageRecycle pdf & image compression: Unauthorized modification of dataCVE-2024-6631 · WordPress plugins & themes · reported by WordfenceMedium 5
The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions, such as updating plugin settings.
Product
ImageRecycle pdf & image compression
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 22, 2024WP SMS: Missing AuthorizationCVE-2024-43331 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3.
Product
WP SMS
Affected
up to 6.9.3
What to do
Affects up to 6.9.3. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 21, 2024Themify Builder: Unauthorized post duplicationCVE-2024-7836 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn't be accessible to them.
Product
Themify Builder
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2024AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Arbitrary file uploadsCVE-2024-7384 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive function in all versions up to, and including, 9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
Affected
up to 9.7.2
What to do
Affects up to 9.7.2. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 21, 2024WPML: Remote Code ExecutionCVE-2024-6386 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Product
WPML
Affected
up to 4.6.12
What to do
Affects up to 4.6.12. Update WPML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sec.stealthcopter.com wpml.org
Aug 21, 2024Woo Inquiry: SQL InjectionCVE-2024-7854 · WordPress plugins & themes · reported by WordfenceCritical 10
The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Woo Inquiry
Affected
up to 0.1
What to do
Affects up to 0.1. Update Woo Inquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 21, 2024App Builder – Create Native Android & iOS Apps On The Flight: Limited SQL InjectionCVE-2024-7651 · WordPress plugins & themes · reported by WordfenceMedium 5.6
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and including, 4.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
App Builder – Create Native Android & iOS Apps On The Flight
Affected
up to 4.2.6
What to do
Affects up to 4.2.6. Update App Builder – Create Native Android & iOS Apps On The Flight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.