Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
349 results · page 4 of 7
Mar 28, 2025MicroPayments: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-31075 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.This issue affects MicroPayments: from n/a through <= 2.9.29.
- Product
- MicroPayments
- Affected
- up to 2.9.29
- What to do
- Affects up to 2.9.29. Update MicroPayments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025tagDiv Composer: Cross-Site Request ForgeryCVE-2025-1705 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The tagDiv Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation within the td_ajax_get_views AJAX action. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- tagDiv Composer
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_usernamCVE-2025-2804 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtagdiv.comwordfence.com
Mar 26, 2025WP Colorful Tag Cloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28865 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lionelroux WP Colorful Tag Cloud wp-colorful-tag-cloud allows Reflected XSS.This issue affects WP Colorful Tag Cloud: from n/a through <= 2.0.1.
- Product
- WP Colorful Tag Cloud
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update WP Colorful Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025UTM tags tracking for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max K UTM tags tracking for Contact Form 7 cf7-utm-tracking allows Reflected XSS.This issue affects UTM tags tracking for Contact Form 7: from n/a through <= 2.1.
- Product
- UTM tags tracking for Contact Form 7
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update UTM tags tracking for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2025InstaWP Connect – 1-click WP Staging & Migration: Cross-Site Request ForgeryCVE-2024-13913 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- InstaWP Connect – 1-click WP Staging & Migration
- Affected
- up to 0.1.0.83
- What to do
- Affects up to 0.1.0.83. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2025Hashtags: Cross-Site Request Forgery (CSRF)CVE-2025-28931 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DevriX Hashtags wp-hashtags allows Stored XSS.This issue affects Hashtags: from n/a through <= 0.3.2.
- Product
- Hashtags
- Affected
- up to 0.3.2
- What to do
- Affects up to 0.3.2. Update Hashtags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025WP FixTag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mohsenshahbazi WP FixTag wp-fixtag allows Reflected XSS.This issue affects WP FixTag: from n/a through <= v2.0.2.
- Product
- WP FixTag
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update WP FixTag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2025PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable.CVE-2025-0769 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 6.3
PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordco.wordpress.orgfluidattacks.com
Feb 28, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WorCVE-2025-1513 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Name and Comment field when commenting on photo gallery entries in all versions up to, and including, 26.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 26.0.0.1
- What to do
- Affects up to 26.0.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 24, 2025Auto Tag Links: Cross-Site Request Forgery (CSRF)CVE-2025-27335 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Free plug in by SEO Roma Auto Tag Links auto-tag-links allows Cross Site Request Forgery.This issue affects Auto Tag Links: from n/a through <= 1.0.13.
- Product
- Auto Tag Links
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Auto Tag Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025WooCommerce Display Products by Tags: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27331 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sébastien Dumont WooCommerce Display Products by Tags woocommerce-display-products-by-tags allows DOM-Based XSS.This issue affects WooCommerce Display Products by Tags: from n/a through <= 1.0.0.
- Product
- WooCommerce Display Products by Tags
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WooCommerce Display Products by Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 22, 2025Migration, Backup, Staging – WPvivid Backup & Migration: Arbitrary file uploadsCVE-2024-13869 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
- Product
- Migration, Backup, Staging – WPvivid Backup & Migration
- Affected
- up to 0.9.112
- What to do
- Affects up to 0.9.112. Update Migration, Backup, Staging – WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 14, 2025Monetag Official: Missing AuthorizationCVE-2024-52500 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
- Product
- Monetag Official
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Monetag Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025Chalet-Montagne.com Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12586 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Chalet-Montagne.com Tools
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Chalet-Montagne.com Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Simple Auto Tag: Cross-Site Request Forgery (CSRF)CVE-2025-25153 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through <= 1.1.
- Product
- Simple Auto Tag
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple Auto Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Tags to Keywords: Cross-Site Request Forgery (CSRF)CVE-2025-22685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in CheGevara29 Tags to Keywords tags-to-meta-keywords allows Stored XSS.This issue affects Tags to Keywords: from n/a through <= 1.0.1.
- Product
- Tags to Keywords
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Tags to Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Meta Tag Manager: Missing AuthorizationCVE-2025-22260 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marcus (aka @msykes) Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through <= 3.1.
- Product
- Meta Tag Manager
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Meta Tag Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WP MediaTagger: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP MediaTagger
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update WP MediaTagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WP MediaTagger: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-13101 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP MediaTagger
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update WP MediaTagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025StageShow: Reflected Cross-Site ScriptingCVE-2024-13705 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 9.8.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- StageShow
- Affected
- up to 9.8.6
- What to do
- Affects up to 9.8.6. Update StageShow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2025WP Multistore Locator: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24680 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Reflected XSS.This issue affects WP Multistore Locator: from n/a through <= 2.4.7.
- Product
- WP Multistore Locator
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Listamester: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24678 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.4.
- Product
- Listamester
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Ketchup Shortcodes: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-24673 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ketchup Shortcodes ketchup-shortcodes-pack allows Stored XSS.This issue affects Ketchup Shortcodes: from n/a through <= 0.1.2.
- Product
- Ketchup Shortcodes
- Affected
- up to 0.1.2
- What to do
- Affects up to 0.1.2. Update Ketchup Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Staging CDN: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23696 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronan Mockett Staging CDN staging-cdn allows Reflected XSS.This issue affects Staging CDN: from n/a through <= 1.0.0.
- Product
- Staging CDN
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Staging CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Tagesteller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Helle1 Tagesteller tagesteller allows Reflected XSS.This issue affects Tagesteller: from n/a through <= v.1.1.
- Product
- Tagesteller
- What to do
- Update Tagesteller to the newest version.
Jan 21, 2025WordPress Tag Cloud Plugin – Tag Groups: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22735 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-groups allows Reflected XSS.This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through <= 2.0.4.
- Product
- WordPress Tag Cloud Plugin – Tag Groups
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update WordPress Tag Cloud Plugin – Tag Groups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Slides & Presentations: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-23919 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Ella Van Durpe Slides & Presentations slide allows Code Injection.This issue affects Slides & Presentations: from n/a through <= 0.0.39.
- Product
- Slides & Presentations
- Affected
- up to 0.0.39
- What to do
- Affects up to 0.0.39. Update Slides & Presentations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Geotagged Media: Cross-Site Request Forgery (CSRF)CVE-2025-23558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in digitalfisherman Geotagged Media geotagged-media allows Stored XSS.This issue affects Geotagged Media: from n/a through <= 0.3.0.
- Product
- Geotagged Media
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update Geotagged Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025add custom google tag manager: Cross-Site Request Forgery (CSRF)CVE-2025-23537 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in קידום ובניית אתרים add custom google tag manager add-custom-google-tag-manager allows Stored XSS.This issue affects add custom google tag manager: from n/a through <= 1.0.3.
- Product
- add custom google tag manager
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update add custom google tag manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP-tagMaker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22338 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lich_wang WP-tagMaker tagmaker allows Reflected XSS.This issue affects WP-tagMaker: from n/a through <= 0.2.2.
- Product
- WP-tagMaker
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update WP-tagMaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025DynamicTags: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22348 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtowebsites DynamicTags dynamictags allows Blind SQL Injection.This issue affects DynamicTags: from n/a through <= 1.4.0.
- Product
- DynamicTags
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update DynamicTags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025PixelYourSite – Your smart PIXEL (TAG) Manager: Cross-Site Request Forgery (CSRF)CVE-2025-22300 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Cross Site Request Forgery.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 10.0.1.2.
- Product
- PixelYourSite – Your smart PIXEL (TAG) Manager
- Affected
- up to 10.0.1.2
- What to do
- Affects up to 10.0.1.2. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Taggbox: Cross-Site Request Forgery (CSRF)CVE-2024-38754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Taggbox Taggbox taggbox-widget allows Cross Site Request Forgery.This issue affects Taggbox: from n/a through <= 3.3.
- Product
- Taggbox
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Auto Tag Creator: Missing AuthorizationCVE-2023-47523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ecreate Infotech Auto Tag Creator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Tag Creator: from n/a through 1.0.2.
- Product
- Auto Tag Creator
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Auto Tag Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 21, 2024Multi-column Tag Map: Stored Cross-Site ScriptingCVE-2024-11196 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mctagmap shortcode in all versions up to, and including, 17.0.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Multi-column Tag Map
- Affected
- up to 17.0.33
- What to do
- Affects up to 17.0.33. Update Multi-column Tag Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2024TagGator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54390 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bouzid Nazim Zitouni TagGator taggator allows Reflected XSS.This issue affects TagGator: from n/a through <= 1.54.
- Product
- TagGator
- Affected
- up to 1.54
- What to do
- Affects up to 1.54. Update TagGator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024STAGGS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in STAGGS STAGGS staggs allows Reflected XSS.This issue affects STAGGS: from n/a through <= 2.0.0.
- Product
- STAGGS
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update STAGGS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Taggbox: Missing AuthorizationCVE-2023-33215 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Taggbox Taggbox taggbox-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taggbox: from n/a through <= 3.3.
- Product
- Taggbox
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Taggbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024ARForms Form Builder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-54223 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through <= 1.7.1.
- Product
- ARForms Form Builder
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update ARForms Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024wpForo Forum: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-47869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affects wpForo Forum: from n/a through 2.2.5.
- Product
- wpForo Forum
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Backup and Staging by WP Time Capsule: Arbitrary file uploadsCVE-2024-8856 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Backup and Staging by WP Time Capsule
- Affected
- up to 1.22.21
- What to do
- Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhacked.beplugins.trac.wordpress.org
Nov 14, 2024Migration, Backup, Staging – WPvivid: PHP Object InjectionCVE-2024-10962 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deserialization of untrusted input in the 'replace_row_data' and 'replace_serialize_data' functions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site to trigger the exploit.
- Product
- Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.107
- What to do
- Affects up to 0.9.107. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2024xili-tidy-tags: Reflected Cross-Site ScriptingCVE-2024-9357 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The xili-tidy-tags plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.12.04 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- xili-tidy-tags
- Affected
- up to 1.12.04
- What to do
- Affects up to 1.12.04. Update xili-tidy-tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 9, 2024Reftagger Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51612 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designerken Reftagger Shortcode reftagger-shortcode allows Stored XSS.This issue affects Reftagger Shortcode: from n/a through <= 1.1.
- Product
- Reftagger Shortcode
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Reftagger Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Geotagged Media: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalfisherman Geotagged Media geotagged-media allows Reflected XSS.This issue affects Geotagged Media: from n/a through <= 0.3.0.
- Product
- Geotagged Media
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update Geotagged Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024CF7 WOW Styler: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-51689 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows Reflected XSS.This issue affects CF7 WOW Styler: from n/a through <= 1.6.8.
- Product
- CF7 WOW Styler
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update CF7 WOW Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2024The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is CVE-2024-10687 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is vulnerable to time-based SQL Injection via the $collectedIds parameter in all versions up to, and including, 24.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected
- up to 24.0.3
- What to do
- Affects up to 24.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 23, 2024Backup and Staging by WP Time Capsule: Deserialization of Untrusted DataCVE-2024-49684 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
- Product
- Backup and Staging by WP Time Capsule
- Affected
- up to 1.22.21
- What to do
- Affects up to 1.22.21. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Woostagram Connect: Unrestricted Upload of File with Dangerous TypeCVE-2024-49327 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in bepitulaz Woostagram Connect woostagram-connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through <= 1.0.2.
- Product
- Woostagram Connect
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Woostagram Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.