Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,673 results · page 365 of 494
Aug 1, 2024Filter & Grids: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39665 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YMC Filter & Grids allows Stored XSS.This issue affects Filter & Grids: from n/a through 2.9.2.
- Product
- Filter & Grids
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024WP Fast Total Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39663 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.68.232.
- Product
- WP Fast Total Search
- Affected
- up to 1.68.232
- What to do
- Affects up to 1.68.232. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Black Widgets For Elementor: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39662 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor allows Stored XSS.This issue affects Black Widgets For Elementor: from n/a through 1.3.5.
- Product
- Black Widgets For Elementor
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Black Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Kubio AI Page Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39661 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ExtendThemes Kubio AI Page Builder.This issue affects Kubio AI Page Builder: from n/a through 2.2.4.
- Product
- Kubio AI Page Builder
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Photo Engine: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39660 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jordy Meow Photo Engine allows Stored XSS.This issue affects Photo Engine: from n/a through 6.3.1.
- Product
- Photo Engine
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Photo Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024WP-PostRatings: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39659 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Stored XSS.This issue affects WP-PostRatings: from n/a through 1.91.1.
- Product
- WP-PostRatings
- Affected
- up to 1.91.1
- What to do
- Affects up to 1.91.1. Update WP-PostRatings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Tin Canny Reporting for LearnDash: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Tin Canny Reporting for LearnDash allows Reflected XSS.This issue affects Tin Canny Reporting for LearnDash: from n/a through 4.3.0.7.
- Product
- Tin Canny Reporting for LearnDash
- Affected
- up to 4.3.0.7
- What to do
- Affects up to 4.3.0.7. Update Tin Canny Reporting for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024LiquidPoll – Advanced Polls for Creators and Brands: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39655 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.77.
- Product
- LiquidPoll – Advanced Polls for Creators and Brands
- Affected
- up to 3.3.77
- What to do
- Affects up to 3.3.77. Update LiquidPoll – Advanced Polls for Creators and Brands to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024WooCommerce PDF Vouchers: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39652 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Reflected XSS.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.
- Product
- WooCommerce PDF Vouchers
- Fixed in
- 4.9.5
- What to do
- Update WooCommerce PDF Vouchers to 4.9.5 or newer.
Aug 1, 2024Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39649 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite.This issue affects Essential Addons for Elementor: from n/a through <= 5.9.26.
- Product
- Essential Addons for Elementor
- Affected
- up to 5.9.26
- What to do
- Affects up to 5.9.26. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Eventin: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39648 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 4.0.5.
- Product
- Eventin
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Better Find and Replace: Deserialization of Untrusted DataCVE-2024-39636 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1.
- Product
- Better Find and Replace
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Better Find and Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Zephyr Project Manager: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38761 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.
- Product
- Zephyr Project Manager
- Affected
- up to 3.3.99
- What to do
- Affects up to 3.3.99. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Timetable and Event Schedule: Deserialization of Untrusted DataCVE-2024-39630 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in MotoPress Timetable and Event Schedule allows Object Injection.This issue affects Timetable and Event Schedule: from n/a through 2.4.13.
- Product
- Timetable and Event Schedule
- Affected
- up to 2.4.13
- What to do
- Affects up to 2.4.13. Update Timetable and Event Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39624 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39621 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39619 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024JetWidgets for Elementor and WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38772 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP Local File Inclusion.This issue affects JetWidgets for Elementor and WooCommerce: from n/a through 1.1.7.
- Product
- JetWidgets for Elementor and WooCommerce
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update JetWidgets for Elementor and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024The Pack Elementor addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38768 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Webangon The Pack Elementor addons allows PHP Local File Inclusion, Path Traversal.This issue affects The Pack Elementor addons: from n/a through 2.0.8.6.
- Product
- The Pack Elementor addons
- Affected
- up to 2.0.8.6
- What to do
- Affects up to 2.0.8.6. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024MakeStories (for Google Web Stories): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MakeStories Team MakeStories (for Google Web Stories) allows Path Traversal, Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through 3.0.3.
- Product
- MakeStories (for Google Web Stories)
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update MakeStories (for Google Web Stories) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024WPForms User Registration: Improper Privilege ManagementCVE-2023-52209 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Privilege Management vulnerability in WPForms, LLC. WPForms User Registration allows Privilege Escalation.This issue affects WPForms User Registration: from n/a through 2.1.0.
- Product
- WPForms User Registration
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WPForms User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-4090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
- Fixed in
- 2.7.2
- What to do
- Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.7.2 or newer.
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some bulk actionsCVE-2024-3983 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.1
- What to do
- Update WooCommerce Customers Manager to 30.1 or newer.
Aug 1, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in various AJAX actionsCVE-2024-1747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.2
- What to do
- Update WooCommerce Customers Manager to 30.2 or newer.
Aug 1, 2024FundEngine: Privilege escalationCVE-2024-6698 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FundEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying user meta updated through the update_user_meta function. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta which can be leveraged to update their capabilities to gain administrator access.
- Product
- FundEngine
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update FundEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 31, 2024CTT Expresso para WooCommerce: Sensitive information exposureCVE-2024-6687 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly accessible and contain sensitive information such as sender and receiver names, phone numbers, physical addresses, and email addresses
- Product
- CTT Expresso para WooCommerce
- Affected
- up to 3.2.12
- What to do
- Affects up to 3.2.12. Update CTT Expresso para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 31, 2024WP Mobile Menu: Unauthorized modification of dataCVE-2024-2508 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the '_mobmenu_icon' post meta to arbitrary posts with an arbitrary (but sanitized) value. NOTE: Version 2.8.4.4 contains a partial fix for this vulnerability.
- Product
- WP Mobile Menu
- Affected
- up to 2.8.4.4
- What to do
- Affects up to 2.8.4.4. Update WP Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 31, 2024it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions.CVE-2024-6695 · WordPress plugins & themes · reported by WPScanCritical 9.8
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
- Fixed in
- 3.11.9
- What to do
- Update the plugin to 3.11.9 or newer.
Jul 30, 2024Donation Block For PayPal: Does not sanitise and escape form submissionsCVE-2024-6021 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site scripting vulnerability
- Product
- Donation Block For PayPal
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Donation Block For PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024CZ Loan Management: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5975 · WordPress plugins & themes · reported by WPScanCritical 9.1
The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- CZ Loan Management
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CZ Loan Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WpStickyBar: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5765 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- WpStickyBar
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection: Does not sanitise and escape some of its settingsCVE-2024-3113 · WordPress plugins & themes · reported by WPScanMedium 5.9
The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection
- Fixed in
- 2.12.2
- What to do
- Update FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection to 2.12.2 or newer.
Jul 30, 2024pmpro-member-directory: Does not prevent users with at least the contributor role from leaking other users' sensitive informationCVE-2024-1287 · WordPress plugins & themes · reported by WPScanMedium 6.5
The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.
- Product
- pmpro-member-directory
- Fixed in
- 1.2.6
- What to do
- Update pmpro-member-directory to 1.2.6 or newer.
Jul 30, 2024pmpro-membership-maps: Does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the siteCVE-2024-1286 · WordPress plugins & themes · reported by WPScanMedium 4.9
The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.
- Product
- pmpro-membership-maps
- Fixed in
- 0.7
- What to do
- Update pmpro-membership-maps to 0.7 or newer.
Jul 29, 2024User Profile Builder: Does not have proper authorisationCVE-2024-6366 · WordPress plugins & themes · reported by WPScanCritical 9.1
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
- Product
- User Profile Builder
- Fixed in
- 3.11.8
- What to do
- Update User Profile Builder to 3.11.8 or newer.
Jul 29, 2024Email Encoder: Does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin pageCVE-2024-4483 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting
- Product
- Email Encoder
- Fixed in
- 2.2.2
- What to do
- Update Email Encoder to 2.2.2 or newer.
Jul 27, 2024Piotnet Addons For Elementor: Sensitive Information ExposureCVE-2024-5614 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'pafe_posts_list' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and excerpts of future, draft, and pending blog posts.
- Product
- Piotnet Addons For Elementor
- Affected
- up to 2.4.29
- What to do
- Affects up to 2.4.29. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2024WooCommerce Product Table Lite: Unauthorized post title modificationCVE-2024-6458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with subscriber access and above to change titles of arbitrary posts. Missing sanitization can lead to Stored Cross-Site Scripting when viewed by an admin via the WooCommerce Product Table.
- Product
- WooCommerce Product Table Lite
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 26, 2024Ultimate WordPress Auction: Unauthorized email creation and sendingCVE-2024-6591 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.
- Product
- Ultimate WordPress Auction
- Affected
- up to 4.2.7
- What to do
- Affects up to 4.2.7. Update Ultimate WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 26, 2024Admin Post Navigation: Full Path DisclosureCVE-2024-6549 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Admin Post Navigation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Admin Post Navigation
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Admin Post Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 26, 2024Flipbox Builder: PHP Object InjectionCVE-2024-6152 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Flipbox Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5 via deserialization of untrusted input in the flipbox_builder_Flipbox_ShortCode function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- Flipbox Builder
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Flipbox Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 26, 2024IgnitionDeck Crowdfunding Platform: Missing AuthorizationCVE-2024-4410 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the ~/classes/class-idf-wizard.php file. This makes it possible for authenticated attackers, with subscriber access or higher, to execute various AJAX actions. This includes actions to change the permalink structure, plugin settings and others.
- Product
- IgnitionDeck Crowdfunding Platform
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update IgnitionDeck Crowdfunding Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 26, 2024Tutor LMS – Migration Tool: Unauthorized modification of dataCVE-2024-1804 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutor_import_from_xml function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to import courses.
- Product
- Tutor LMS – Migration Tool
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Tutor LMS – Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 26, 2024Tutor LMS – Migration Tool: Unauthorized access of dataCVE-2024-1798 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tutor_lp_export_xml function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to export courses, including private and password protected courses.
- Product
- Tutor LMS – Migration Tool
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Tutor LMS – Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 25, 2024LearnPress – WordPress LMS: Local File InclusionCVE-2024-6589 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- LearnPress – WordPress LMS
- Affected
- up to 4.2.6.8.2
- What to do
- Affects up to 4.2.6.8.2. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2024WP Meteor Website Speed Optimization Addon: Full Path DisclosureCVE-2024-6553 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is due to the plugin utilizing wpdesk and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- WP Meteor Website Speed Optimization Addon
- Affected
- up to 3.4.3.This
- What to do
- Affects up to 3.4.3.This. Update WP Meteor Website Speed Optimization Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 24, 2024WP EasyPay – Square for: Unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() functionCVE-2024-5861 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.
- Product
- WP EasyPay – Square for
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update WP EasyPay – Square for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2024WooCommerce - PDF Vouchers: Authentication bypassCVE-2024-7027 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WooCommerce - PDF Vouchers plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.3. This is due to insufficient verification on the user being supplied during a QR code login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing Voucher Vendor user on the site, if they have access to the user id.
- Product
- WooCommerce - PDF Vouchers
- Affected
- up to 4.9.3
- What to do
- Affects up to 4.9.3. Update WooCommerce - PDF Vouchers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 23, 2024Social Auto Poster: Unauthorized modification and loss of dataCVE-2024-6755 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘wpw_auto_poster_quick_delete_multiple’ function in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to delete arbitrary posts.
- Product
- Social Auto Poster
- Affected
- up to 5.3.14
- What to do
- Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 23, 2024Social Auto Poster: Unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ functionCVE-2024-6754 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata.
- Product
- Social Auto Poster
- Affected
- up to 5.3.14
- What to do
- Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.