Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

38added in the last 30 days

561new WordPress flaws this week

398,769entries in the database

38,964 results · page 363 of 780

Jan 2, 2024In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value.CVE-2023-48418 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 10
In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation
Product
Pixel Watch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com source.android.com
Jan 2, 2024Google Nest WiFi Pro root code-execution & user-data compromiseCVE-2023-6339 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 10
Google Nest WiFi Pro root code-execution & user-data compromise
Product
Wifi Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.google.com vuldb.com
Jan 2, 2024OTCLient is an alternative tibia client for otserv.CVE-2024-21623 · Other software · mehah · reported by GitHubCritical 9.8
OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "`Analysis - SonarCloud`" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and alter the repository using this workflow. Commit db560de0b56476c87a2f967466407939196dd254 contains a fix for this issue.
Product
otclient
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 2, 2024An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework.CVE-2023-47458 · Other software · Bladex · reported by MITRECritical 9.8
An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework.
Product
Springblade
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gitee.com
Jan 2, 2024An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege CVE-2023-48419 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 10
An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege
Product
Google Nest Mini
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.google.com support.google.com
Jan 2, 2024An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory fCVE-2023-4280 · Other software · silabs.com · reported by product-security@silabs.comCritical 9.3
An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.
Product
GSDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.silabs.com github.com
Jan 2, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection.CVE-2023-6436 · Other software · Ekol Informatics · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection. This issue affects Website Template: through 20231215.
Product
Website Template
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jan 2, 2024Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.CVE-2023-33032 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.3
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jan 2, 2024Memory corruption in HLOS while running playready use-case.CVE-2023-33030 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.3
Memory corruption in HLOS while running playready use-case.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jan 2, 2024Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.CVE-2023-33025 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jan 1, 2024In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check.CVE-2023-32874 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comCritical 9.8
In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161803; Issue ID: MOLY01161803 (MSV-893).
Product
MT2735, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6789, MT6813, MT6833, MT6833P, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT68
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com corp.mediatek.com
Jan 1, 2024affiliate-toolkit: Lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiverCVE-2023-5877 · WordPress plugins & themes · reported by WPScanCritical 9.8
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.
Product
affiliate-toolkit
Fixed in
3.4.3
What to do
Update affiliate-toolkit to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 31, 2023Checkout Mestres WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51469 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Checkout Mestres WP: from n/a through 7.1.9.6.
Product
Checkout Mestres WP
Affected
up to 7.1.9.6
What to do
Affects up to 7.1.9.6. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51423 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
Product
Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Affected
up to 3.05.0
What to do
Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023YITH WooCommerce Product Add-Ons: Deserialization of Untrusted DataCVE-2023-49777 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023ARI Stream Quiz – WordPress Quizzes Builder: Deserialization of Untrusted DataCVE-2023-52182 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes Builder: from n/a through 1.3.0.
Product
ARI Stream Quiz – WordPress Quizzes Builder
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update ARI Stream Quiz – WordPress Quizzes Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Theme per user: Deserialization of Untrusted DataCVE-2023-52181 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1.
Product
Theme per user
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Theme per user to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023JetElements For Elementor: Improper Control of Generation of Code ('Code Injection')CVE-2023-39157 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.
Product
JetElements For Elementor
Affected
up to 2.6.10
What to do
Affects up to 2.6.10. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 30, 2023outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used CVE-2023-52262 · Other software · Outdoorbits · reported by MITRECritical 9.8
outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.
Product
Little Backup BOX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com php.net
Dec 30, 2023TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.CVE-2023-50651 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.
Product
X6000r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record palm-jump-676.notion.site palm-jump-676.notion.site
Dec 30, 2023Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.CVE-2023-50589 · Other software · Embras · reported by MITRECritical 9.8
Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.
Product
Geosiap ERP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cheatsheetseries.owasp.org github.com
Dec 30, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule.CVE-2023-51136 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule.
Product
X2000r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com totolink.cn
Dec 30, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup.CVE-2023-51135 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup.
Product
X2000r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com totolink.cn
Dec 30, 2023TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.CVE-2023-51133 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.
Product
X2000r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com totolink.cn
Dec 30, 2023Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.CVE-2023-50578 · Other software · Mingsoft · reported by MITRECritical 9.8
Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.
Product
Mcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitee.com gitee.com
Dec 30, 2023Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.CVE-2023-52252 · Other software · Unifiedremote · reported by MITRECritical 9.8
Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.
Product
Unified Remote
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record harkenzo.tlstickle.com exploit-db.com
Dec 29, 2023SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableDCVE-2023-41544 · Other software · Jeecg · reported by MITRECritical 9.8
SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.
Product
Jeecg Boot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pho3n1x-web.github.io pho3n1x-web.github.io
Dec 29, 2023SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicaCVE-2023-41543 · Other software · Jeecg · reported by MITRECritical 9.8
SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.
Product
Jeecg Boot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mp.weixin.qq.com pho3n1x-web.github.io
Dec 29, 2023SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestCVE-2023-41542 · Other software · Jeecg · reported by MITRECritical 9.8
SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.
Product
Jeecg Boot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pho3n1x-web.github.io pho3n1x-web.github.io
Dec 29, 2023Misskey is an open source, decentralized social media platform.CVE-2023-52139 · Other software · misskey-dev · reported by GitHubCritical 9
Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).
Product
misskey
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 29, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GM Information Technologies MDO allows SQL Injection.CVE-2023-4675 · Other software · GM Information Technologies · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GM Information Technologies MDO allows SQL Injection. This issue affects MDO: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
MDO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Dec 29, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection.CVE-2023-4541 · Other software · Ween Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
Admin Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Dec 29, 2023WP MLM SOFTWARE: Unrestricted Upload of File with Dangerous TypeCVE-2023-51475 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN.This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.
Product
WP MLM SOFTWARE
Affected
up to 4.0
What to do
Affects up to 4.0. Update WP MLM SOFTWARE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023TerraClassifieds – Simple Classifieds: Unrestricted Upload of File with Dangerous TypeCVE-2023-51473 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.
Product
TerraClassifieds – Simple Classifieds
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update TerraClassifieds – Simple Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Rencontre – Dating Site: Unrestricted Upload of File with Dangerous TypeCVE-2023-51468 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.
Product
Rencontre – Dating Site
Affected
up to 3.10.1
What to do
Affects up to 3.10.1. Update Rencontre – Dating Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Verge3D Publishing and E-Commerce: Unrestricted Upload of File with Dangerous TypeCVE-2023-51421 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.
Product
Verge3D Publishing and E-Commerce
Affected
up to 4.5.2
What to do
Affects up to 4.5.2. Update Verge3D Publishing and E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023BERTHA AI. Your AI co-pilot for WordPress and Chrome: Unrestricted Upload of File with Dangerous TypeCVE-2023-51419 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.
Product
BERTHA AI. Your AI co-pilot for WordPress and Chrome
Affected
up to 1.11.10.7
What to do
Affects up to 1.11.10.7. Update BERTHA AI. Your AI co-pilot for WordPress and Chrome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023JVM Gutenberg Rich Text Icons: Unrestricted Upload of File with Dangerous TypeCVE-2023-51417 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.
Product
JVM Gutenberg Rich Text Icons
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update JVM Gutenberg Rich Text Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Piotnet Forms: Unrestricted Upload of File with Dangerous TypeCVE-2023-51412 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.25.
Product
Piotnet Forms
Affected
up to 1.0.25
What to do
Affects up to 1.0.25. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Frontend Admin by DynamiApps: Unrestricted Upload of File with Dangerous TypeCVE-2023-51411 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.
Product
Frontend Admin by DynamiApps
Affected
up to 3.18.3
What to do
Affects up to 3.18.3. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023WP Mail Log: Unrestricted Upload of File with Dangerous TypeCVE-2023-51410 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2.
Product
WP Mail Log
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Mail Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Job Manager & Career – Manage job board listings, and recruitments: Cross-Site Request Forgery (CSRF), Deserialization of Untrusted DataCVE-2023-51545 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.
Product
Job Manager & Career – Manage job board listings, and recruitments
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Job Manager & Career – Manage job board listings, and recruitments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Deserialization of Untrusted DataCVE-2023-51505 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Rencontre – Dating Site: Deserialization of Untrusted DataCVE-2023-51470 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11.1.
Product
Rencontre – Dating Site
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Rencontre – Dating Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Deserialization of Untrusted DataCVE-2023-51422 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
Product
Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Affected
up to 3.05.0
What to do
Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023EnvíaloSimple: Email Marketing y Newsletters: Deserialization of Untrusted DataCVE-2023-51414 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.
Product
EnvíaloSimple: Email Marketing y Newsletters
Affected
up to 2.1
What to do
Affects up to 2.1. Update EnvíaloSimple: Email Marketing y Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Verge3D Publishing and E-Commerce: Improper Control of Generation of Code ('Code Injection')CVE-2023-51420 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.
Product
Verge3D Publishing and E-Commerce
Affected
up to 4.5.2
What to do
Affects up to 4.5.2. Update Verge3D Publishing and E-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Astra Pro: Improper Control of Generation of Code ('Code Injection')CVE-2023-49830 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Brainstorm Force Astra Pro.This issue affects Astra Pro: from n/a through 4.3.1.
Product
Astra Pro
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update Astra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Qode Essential Addons: Improper Control of Generation of Code ('Code Injection')CVE-2023-47840 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.5.2.
Product
Qode Essential Addons
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Qode Essential Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023WP EXtra: Improper Control of Generation of Code ('Code Injection')CVE-2023-46623 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in TienCOP WP EXtra.This issue affects WP EXtra: from n/a through 6.2.
Product
WP EXtra
Affected
up to 6.2
What to do
Affects up to 6.2. Update WP EXtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.