Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

428new WordPress flaws this week

399,168entries in the database

24,763 results · page 401 of 496

Apr 10, 2024Bricksforge: Missing AuthorizationCVE-2024-31242 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.
Product
Bricksforge
Affected
up to 2.0.17
What to do
Affects up to 2.0.17. Update Bricksforge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024ShortPixel Adaptive Images: Missing AuthorizationCVE-2024-31230 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.2.
Product
ShortPixel Adaptive Images
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024User Activity Log: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31356 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User Activity Log: from n/a through 1.8.
Product
User Activity Log
Affected
up to 1.8
What to do
Affects up to 1.8. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Slideshow Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31355 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
Product
Slideshow Gallery
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2024-31343 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.1.
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Affected
up to 4.10.1
What to do
Affects up to 4.10.1. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WordPress Gallery Exporter: Missing AuthorizationCVE-2024-31342 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPcloudgallery WordPress Gallery Exporter.This issue affects WordPress Gallery Exporter: from n/a through 1.3.
Product
WordPress Gallery Exporter
Affected
up to 1.3
What to do
Affects up to 1.3. Update WordPress Gallery Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024ReDi Restaurant Reservation: Cross-Site Request Forgery (CSRF)CVE-2024-31299 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Reservation Diary ReDi Restaurant Reservation allows Cross-Site Scripting (XSS).This issue affects ReDi Restaurant Reservation: from n/a through 24.0128.
Product
ReDi Restaurant Reservation
Affected
up to 24.0128
What to do
Affects up to 24.0128. Update ReDi Restaurant Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 20245 Stars Rating Funnel: Missing AuthorizationCVE-2024-31358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.2.67.
Product
5 Stars Rating Funnel
Affected
up to 1.2.67
What to do
Affects up to 1.2.67. Update 5 Stars Rating Funnel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Slideshow Gallery: Insertion of Sensitive Information into Log FileCVE-2024-31353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
Product
Slideshow Gallery
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Contact Form Email: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-31302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44.
Product
Contact Form Email
Affected
up to 1.3.44
What to do
Affects up to 1.3.44. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024User Spam Remover: Insertion of Sensitive Information into Log FileCVE-2024-31298 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0.
Product
User Spam Remover
Affected
up to 1.0
What to do
Affects up to 1.0. Update User Spam Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Wholesale For WooCommerce: Missing AuthorizationCVE-2024-31297 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.
Product
Wholesale For WooCommerce
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Wholesale For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Media Library Folders: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-31287 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8.
Product
Media Library Folders
Affected
up to 8.1.8
What to do
Affects up to 8.1.8. Update Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024App Builder: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-31282 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Appcheap.Io App Builder.This issue affects App Builder: from n/a through 3.8.7.
Product
App Builder
Affected
up to 3.8.7
What to do
Affects up to 3.8.7. Update App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Premium Addons for Elementor: Insertion of Sensitive Information Into Sent DataCVE-2024-31278 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.22.
Product
Premium Addons for Elementor
Affected
up to 4.10.22
What to do
Affects up to 4.10.22. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024SearchIQ: Insertion of Sensitive Information into Log FileCVE-2024-31259 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information into Log File vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.5.
Product
SearchIQ
Affected
up to 4.5
What to do
Affects up to 4.5. Update SearchIQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WordPress Backup & Migration: Insertion of Sensitive Information into Log FileCVE-2024-31254 · WordPress plugins & themes · reported by PatchstackLow 3.7
Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.7.
Product
WordPress Backup & Migration
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024OAuth Server: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-31253 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.This issue affects OAuth Server: from n/a through 4.3.3.
Product
OAuth Server
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update OAuth Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Subscribe To Comments Reloaded: Insertion of Sensitive Information into Log FileCVE-2024-31249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725.
Product
Subscribe To Comments Reloaded
Affected
up to 220725
What to do
Affects up to 220725. Update Subscribe To Comments Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024FG Drupal to: Insertion of Sensitive Information into Log FileCVE-2024-31247 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3.
Product
FG Drupal to
Affected
up to 3.70.3
What to do
Affects up to 3.70.3. Update FG Drupal to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024ConvertKit: Insertion of Sensitive Information into Log FileCVE-2024-31245 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5.
Product
ConvertKit
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update ConvertKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024WP Poll Maker: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-31240 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in InfoTheme WP Poll Maker.This issue affects WP Poll Maker: from n/a through 3.1.
Product
WP Poll Maker
Affected
up to 3.1
What to do
Affects up to 3.1. Update WP Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Stored Cross-Site ScriptingCVE-2024-3210 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'reg-single-checkbox' shortcode in all versions up to, and including, 4.15.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.15.5
What to do
Affects up to 4.15.5. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024Essential Grid Gallery: Sensitive Information ExposureCVE-2024-3235 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Grid Gallery WordPress Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the on_front_ajax_action() function. This makes it possible for unauthenticated attackers to view private and password protected posts that may have private or sensitive information.
Product
Essential Grid Gallery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Essential Grid Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record essential-grid.com wordfence.com
Apr 10, 2024The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'sCVE-2024-3020 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The plugin is vulnerable to PHP Object Injection in versions up to and including, 2.6.3 via deserialization of untrusted input in the import function via the 'shortcode' parameter. This allows authenticated attackers, with administrator-level access to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 10, 2024WP Radio – Worldwide Online Radio Stations Directory for: Unauthorized modification of dataCVE-2024-1042 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 3.1.9. This makes it possible for authenticated attackers, with subscriber access and above, to import radio stations, remove countries, and modify the plugin's settings, which can lead to Cross-Site Scripting, tracked separately in CVE-2024-1041.
Product
WP Radio – Worldwide Online Radio Stations Directory for
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update WP Radio – Worldwide Online Radio Stations Directory for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 10, 2024WP Radio – Worldwide Online Radio Stations Directory for: Stored Cross-Site ScriptingCVE-2024-1041 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping as well as insufficient access control on the settings. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Radio – Worldwide Online Radio Stations Directory for
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update WP Radio – Worldwide Online Radio Stations Directory for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 9, 2024Relevanssi – A Better Search: CSV InjectionCVE-2024-3214 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Product
Relevanssi – A Better Search
Affected
up to 4.22.1
What to do
Affects up to 4.22.1. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Relevanssi – A Better Search: Unauthorized modification of dataCVE-2024-3213 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the relevanssi_update_counts() function in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to execute expensive queries on the application that could lead into DOS.
Product
Relevanssi – A Better Search
Affected
up to 4.22.1
What to do
Affects up to 4.22.1. Update Relevanssi – A Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024MasterStudy LMS: Local File InclusionCVE-2024-3136 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
MasterStudy LMS
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Sensitive Information ExposureCVE-2024-2974 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.9.13 via the load_more function. This can allow unauthenticated attackers to extract sensitive data including private and draft posts.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 5.9.13
What to do
Affects up to 5.9.13. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-2946 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's QR Code Widget in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)
Affected
up to 2.8.4
What to do
Affects up to 2.8.4. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Media Library Assistant: SQL InjectionCVE-2024-2871 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Media Library Assistant
Affected
up to 3.13
What to do
Affects up to 3.13. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2024-2845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Network Summary: SQL InjectionCVE-2024-2804 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter in all versions up to, and including, 2.0.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Network Summary
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Network Summary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in: Stored Cross-Site ScriptingCVE-2024-2783 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Link Whisper Free: PHP Object InjectionCVE-2024-2693 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.7.1 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Link Whisper Free
Affected
up to 0.7.1
What to do
Affects up to 0.7.1. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Hubbub Lite – Fast, Reliable Social Sharing Buttons: PHP Object InjectionCVE-2024-2501 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Hubbub Lite – Fast, Reliable Social Sharing Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.33.1 via deserialization of untrusted input via the 'dpsp_maybe_unserialize' function. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Hubbub Lite – Fast, Reliable Social Sharing Buttons
Affected
up to 1.33.1
What to do
Affects up to 1.33.1. Update Hubbub Lite – Fast, Reliable Social Sharing Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Lightweight Accordion: Stored Cross-Site ScriptingCVE-2024-2436 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lightweight Accordion
Affected
up to 1.5.16
What to do
Affects up to 1.5.16. Update Lightweight Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Stored Cross-Site ScriptingCVE-2024-2423 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Avada: SQL InjectionCVE-2024-2344 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticted attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Avada
Affected
up to 7.11.6
What to do
Affects up to 7.11.6. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avada.com gist.github.com
Apr 9, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: SQL InjectionCVE-2024-2342 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.7.7
What to do
Affects up to 1.6.7.7. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: SQL InjectionCVE-2024-2341 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.7.7
What to do
Affects up to 1.6.7.7. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Avada: Sensitive Information ExposureCVE-2024-2340 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.
Product
Avada
Affected
up to 7.11.6
What to do
Affects up to 7.11.6. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avada.com wordfence.com
Apr 9, 2024Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy): Sensitive Information ExposureCVE-2024-2302 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII.
Product
Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy)
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Event Tickets and Registration: Sensitive Information ExposureCVE-2024-2261 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including emails and street addresses.
Product
Event Tickets and Registration
Affected
up to 5.8.2
What to do
Affects up to 5.8.2. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Sensitive Information ExposureCVE-2024-2112 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.15.22 via the signature functionality. This makes it possible for unauthenticated attackers to extract sensitive data including user signatures.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.22
What to do
Affects up to 1.15.22. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024VK All in One Expansion Unit: Sensitive Information ExposureCVE-2024-2093 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.95.0.1 via social meta tags. This makes it possible for unauthenticated attackers to view limited password protected content.
Product
VK All in One Expansion Unit
Affected
up to 9.95.0.1
What to do
Affects up to 9.95.0.1. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Apr 9, 2024Video Conferencing with Zoom: Sensitive Information ExposureCVE-2024-2033 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the get_assign_host_id AJAX action. This makes it possible for authenticated attackers, with subscriber access or higher, to enumerate usernames, emails and IDs of all users on a site.
Product
Video Conferencing with Zoom
Affected
up to 4.4.5
What to do
Affects up to 4.4.5. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024WP Activity Log Premium: SQL InjectionCVE-2024-2018 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. One demonstrated attack included the injection of a PHP Object.
Product
WP Activity Log Premium
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update WP Activity Log Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record melapress.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.