Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

389 results · page 4 of 8

Feb 18, 2025Shopwarden – Automated WooCommerce monitoring & testing: Cross-Site Request ForgeryCVE-2024-13315 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.11. This is due to missing or incorrect nonce validation on the save_setting() function. This makes it possible for unauthenticated attackers to update arbitrary options and achieve privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Shopwarden – Automated WooCommerce monitoring & testing
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Shopwarden – Automated WooCommerce monitoring & testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2025Monetag Official: Missing AuthorizationCVE-2024-52500 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
Product
Monetag Official
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Monetag Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Chalet-Montagne.com Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12586 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Chalet-Montagne.com Tools
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Chalet-Montagne.com Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 7, 2025WP Keyword Monitor: Cross-Site Request Forgery (CSRF)CVE-2025-25088 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyword Monitor: from n/a through <= 1.0.5.
Product
WP Keyword Monitor
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP Keyword Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not have CSRF check in some placesCVE-2024-13115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
WP Projects Portfolio with Client Testimonials
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13114 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Projects Portfolio with Client Testimonials
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 31, 2025WP Sessions Time Monitoring Full Automatic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Reflected XSS.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.1.
Product
WP Sessions Time Monitoring Full Automatic
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 30, 2025WE – Testimonial Slider: Stored Cross-Site ScriptingCVE-2024-13460 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WE – Testimonial Slider
Affected
up to 1.5
What to do
Affects up to 1.5. Update WE – Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 25, 2025Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More: Stored Cross-Site ScriptingCVE-2025-0350 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2025Simple Download Monitor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24663 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through <= 3.9.25.
Product
Simple Download Monitor
Affected
up to 3.9.25
What to do
Affects up to 3.9.25. Update Simple Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Web Testimonials: Cross-Site Request Forgery (CSRF)CVE-2025-23560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through <= 1.2.
Product
Web Testimonials
Affected
up to 1.2
What to do
Affects up to 1.2. Update Web Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Social proof testimonials and reviews by Repuso: Stored Cross-Site ScriptingCVE-2024-13351 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Social proof testimonials and reviews by Repuso plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rw_image_badge1' shortcode in all versions up to, and including, 5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social proof testimonials and reviews by Repuso
Affected
up to 5.20
What to do
Affects up to 5.20. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 14, 2025Car Demon: Reflected Cross-Site ScriptingCVE-2024-13334 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_condition' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Car Demon
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Car Demon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 13, 2025Event Monster – Event Management, Tickets Booking, Upcoming Event: Information ExposureCVE-2024-11396 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.
Product
Event Monster – Event Management, Tickets Booking, Upcoming Event
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2025Backlink Monitoring Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12714 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Backlink Monitoring Manager
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Backlink Monitoring Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 7, 2025Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites: Stored Cross-Site ScriptingCVE-2024-11382 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'commonninja' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 2, 2025Preloader by WordPress Monsters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56022 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress Monsters Preloader by WordPress Monsters preloader-sws allows Reflected XSS.This issue affects Preloader by WordPress Monsters: from n/a through <= 1.2.3.
Product
Preloader by WordPress Monsters
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Preloader by WordPress Monsters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Travel Monster: Cross-Site Request Forgery (CSRF)CVE-2024-37272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wptravelengine Travel Monster travel-monster allows Cross Site Request Forgery.This issue affects Travel Monster: from n/a through <= 1.1.2.
Product
Travel Monster
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Travel Monster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2023-46196 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 4.97.
Product
Social proof testimonials and reviews by Repuso
Affected
up to 4.97
What to do
Affects up to 4.97. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Lemonade Social Networks Autoposter Pinterest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56028 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lemonadestudio Lemonade Social Networks Autoposter Pinterest lemonade-sna-pinterest-edition allows Reflected XSS.This issue affects Lemonade Social Networks Autoposter Pinterest: from n/a through <= 2.0.
Product
Lemonade Social Networks Autoposter Pinterest
Affected
up to 2.0
What to do
Affects up to 2.0. Update Lemonade Social Networks Autoposter Pinterest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 21, 2024Pingmeter Uptime Monitoring: Reflected Cross-Site ScriptingCVE-2024-11808 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Pingmeter Uptime Monitoring plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Pingmeter Uptime Monitoring
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Pingmeter Uptime Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2024Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart: Cross-Site Request Forgery (CSRF)CVE-2024-54386 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in pushmonkey Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart push-monkey-desktop-push-notifications allows Cross Site Request Forgery.This issue affects Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart: from n/a through <= 3.9.
Product
Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart
Affected
up to 3.9
What to do
Affects up to 3.9. Update Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 8, 2024WP Umbrella: Update Backup Restore & Monitoring: Local File InclusionCVE-2024-12209 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename' parameter of the 'umbrella-restore' action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
WP Umbrella: Update Backup Restore & Monitoring
Affected
up to 2.17.0
What to do
Affects up to 2.17.0. Update WP Umbrella: Update Backup Restore & Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2024Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials: Local File InclusionCVE-2024-11429 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'stars-testimonials-with-slider-and-masonry-grid' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.
Product
Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 4, 2024B Testimonial – testimonial plugin for WP: Stored Cross-Site ScriptingCVE-2024-11880 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
B Testimonial – testimonial plugin for WP
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update B Testimonial – testimonial plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 3, 2024Campaign Monitor Forms by Optin Cat: Reflected Cross-Site ScriptingCVE-2024-11326 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Campaign Monitor Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Campaign Monitor Forms by Optin Cat
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update Campaign Monitor Forms by Optin Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2024Tribute Testimonials – WordPress Testimonial Grid/Slider: Stored Cross-Site ScriptingCVE-2024-10886 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tribute_testimonials_slider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tribute Testimonials – WordPress Testimonial Grid/Slider
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Tribute Testimonials – WordPress Testimonial Grid/Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2024Activity Log – Monitor & Record User Changes: Stored Cross-Site ScriptingCVE-2024-10788 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Activity Log – Monitor & Record User Changes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event parameters in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.
Product
Activity Log – Monitor & Record User Changes
Affected
up to 2.11.1
What to do
Affects up to 2.11.1. Update Activity Log – Monitor & Record User Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 19, 2024ESB Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51936 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eSparkBiz ESB Testimonials esb-testimonials allows Stored XSS.This issue affects ESB Testimonials: from n/a through <= 1.0.0.
Product
ESB Testimonials
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update ESB Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Testimonial Slider Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51925 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sazzad Testimonial Slider Shortcode testimonial-slider-shortcode allows Stored XSS.This issue affects Testimonial Slider Shortcode: from n/a through <= 1.1.9.
Product
Testimonial Slider Shortcode
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Testimonial Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Luzuk Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51872 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in luzuk Themes Luzuk Testimonials luzuk-testimonials allows Stored XSS.This issue affects Luzuk Testimonials: from n/a through <= 0.0.1.
Product
Luzuk Testimonials
Affected
up to 0.0.1
What to do
Affects up to 0.0.1. Update Luzuk Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Faltu Testimonial Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51853 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alberuni Azad. Faltu Testimonial Rotator faltu-testimonial-rotator allows DOM-Based XSS.This issue affects Faltu Testimonial Rotator: from n/a through <= 1.0.0.
Product
Faltu Testimonial Rotator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Faltu Testimonial Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Awesome Fitness Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51806 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shingo Awesome Fitness Testimonials awesome-fitness-testimonials allows Stored XSS.This issue affects Awesome Fitness Testimonials: from n/a through <= 1.0.1.
Product
Awesome Fitness Testimonials
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Awesome Fitness Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024EndomondoWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Odyno EndomondoWP endomondowp allows Stored XSS.This issue affects EndomondoWP: from n/a through <= 0.1.1.
Product
EndomondoWP
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update EndomondoWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 15, 2024404 Error Monitor: Cross-Site Request ForgeryCVE-2024-11118 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 404 Error Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the updatePluginSettings() function. This makes it possible for unauthenticated attackers to make changes to plugin settings and clear up all the error logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
404 Error Monitor
Affected
up to 1.1
What to do
Affects up to 1.1. Update 404 Error Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 12, 2024Social Proof (Testimonial) Slider: Stored Cross-Site ScriptingCVE-2024-8985 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Proof (Testimonial) Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's spslider-block shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Proof (Testimonial) Slider
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Social Proof (Testimonial) Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 9, 2024Aajoda Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51614 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aajoda Aajoda Testimonials aajoda-testimonials allows Stored XSS.This issue affects Aajoda Testimonials: from n/a through <= 2.2.2.
Product
Aajoda Testimonials
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Aajoda Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Strong Testimonials: Missing AuthorizationCVE-2024-47362 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.
Product
Strong Testimonials
Affected
up to 3.1.16
What to do
Affects up to 3.1.16. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Contact Form 7 Campaign Monitor Extension: Missing AuthorizationCVE-2024-44019 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension contact-form-7-campaign-monitor-extension.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through <= 0.4.67.
Product
Contact Form 7 Campaign Monitor Extension
Affected
up to 0.4.67
What to do
Affects up to 0.4.67. Update Contact Form 7 Campaign Monitor Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 30, 2024Download Monitor: Unauthorized modification of dataCVE-2024-10399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain usernames and emails of site users.
Product
Download Monitor
Affected
up to 5.0.13
What to do
Affects up to 5.0.13. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2024Monitor.chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49639 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Stoever Monitor.chat monitor-chat allows Reflected XSS.This issue affects Monitor.chat: from n/a through <= 1.1.1.
Product
Monitor.chat
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Monitor.chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024Advanced Sermons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50458 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored XSS.This issue affects Advanced Sermons: from n/a through <= 3.4.
Product
Advanced Sermons
Affected
up to 3.4
What to do
Affects up to 3.4. Update Advanced Sermons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2024Monkee-Boy Essentials: Stored Cross-Site ScriptingCVE-2024-9116 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Monkee-Boy Essentials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Monkee-Boy Essentials
Affected
up to 1.1
What to do
Affects up to 1.1. Update Monkee-Boy Essentials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 26, 2024Download Monitor: Unauthorized modification of dataCVE-2024-10092 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actions function in all versions up to, and including, 5.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to revoke existing API keys and generate new ones.
Product
Download Monitor
Affected
up to 5.0.12
What to do
Affects up to 5.0.12. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2024WP Sessions Time Monitoring Full Automatic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49681 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows SQL Injection.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.0.9.
Product
WP Sessions Time Monitoring Full Automatic
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024SermonAudio Widgets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-49614 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SermonAudio SermonAudio Widgets sermonaudio-widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through <= 1.9.3.
Product
SermonAudio Widgets
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update SermonAudio Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024Simple Testimonials Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49295 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase simple-testimonials-showcase allows Stored XSS.This issue affects Simple Testimonials Showcase: from n/a through <= 1.1.6.
Product
Simple Testimonials Showcase
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Simple Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 17, 2024wp-Monalisa: Cross-Site Request Forgery (CSRF)CVE-2024-48038 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in tuxlog wp-Monalisa wp-monalisa.This issue affects wp-Monalisa: from n/a through <= 6.4.
Product
wp-Monalisa
Affected
up to 6.4
What to do
Affects up to 6.4. Update wp-Monalisa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Download Monitor: Authorization bypassCVE-2022-4972 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporting in versions up to, and including, 4.7.51. This makes it possible for unauthenticated attackers to view user data and other sensitive information intended for administrators.
Product
Download Monitor
Affected
up to 4.7.51
What to do
Affects up to 4.7.51. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2024The AADMY – Add Auto Date Month Year Into Posts: Arbitrary shortcode executionCVE-2024-9837 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The AADMY – Add Auto Date Month Year Into Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The AADMY – Add Auto Date Month Year Into Posts
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update The AADMY – Add Auto Date Month Year Into Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.