Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

428new WordPress flaws this week

399,168entries in the database

24,763 results · page 402 of 496

Apr 9, 2024RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Privilege escalationCVE-2024-1991 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.3.0.0
What to do
Affects up to 5.3.0.0. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Blind SQL InjectionCVE-2024-1990 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 5.3.1.0
What to do
Affects up to 5.3.1.0. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor): Stored Cross-Site ScriptingCVE-2024-1960 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Special Offer Day Widget Banner Link in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WP Compress – Image Optimizer: Unauthorized modification of dataCVE-2024-1934 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all versions up to, and including, 6.11.10. This makes it possible for unauthenticated attackers to reset the CDN region and set a malicious URL to deliver images.
Product
WP Compress – Image Optimizer
Affected
up to 6.11.10
What to do
Affects up to 6.11.10. Update WP Compress – Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Easy Property Listings: Time-based SQL InjectionCVE-2024-1893 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Easy Property Listings
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024AI Post Generator | AutoWriter: Unauthorized access, modification or deletion of postsCVE-2024-1850 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with subscriber access or higher, to view all posts generated with this plugin (even in non-published status), create new posts (and publish them), publish unpublished post or perform post deletions. CVE-2024-32713 may be a duplicate of this issue.
Product
AI Post Generator | AutoWriter
Affected
up to 3.3
What to do
Affects up to 3.3. Update AI Post Generator | AutoWriter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Simple Job Board: PHP Object InjectionCVE-2024-1813 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitted job application is viewed.
Product
Simple Job Board
Affected
up to 2.11.0
What to do
Affects up to 2.11.0. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024CMB2: PHP Object InjectionCVE-2024-1792 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CMB2 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.1 via deserialization of untrusted input from the text_datetime_timestamp_timezone field. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Please note that the plugin is a developer toolkit. For the vulnerability to become exploitable, the presence of a metabox activation in your code (via functions.php for example) is required.
Product
CMB2
Affected
up to 2.10.1
What to do
Affects up to 2.10.1. Update CMB2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Accordion: Unauthorized access of data and modification of dataCVE-2024-1641 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'accordions_duplicate_post_as_draft' function in all versions up to, and including, 2.2.96. This makes it possible for authenticated attackers, with contributor access and above, to duplicate arbitrary posts, allowing access to the contents of password-protected posts.
Product
Accordion
Affected
up to 2.2.96
What to do
Affects up to 2.2.96. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024360 Javascript Viewer: Unauthorized modification of dataCVE-2024-1637 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access or higher, to update plugin settings.
Product
360 Javascript Viewer
Affected
up to 1.7.12
What to do
Affects up to 1.7.12. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Newsmatic: Sensitive Information ExposureCVE-2024-1587 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmatic_filter_posts_load_tab_content'. This makes it possible for unauthenticated attackers to view draft posts and post content.
Product
Newsmatic
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Newsmatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Apr 9, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-1424 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Classified Listing – Classified ads & Business Directory: Unauthorized access & modification of dataCVE-2024-1352 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtcl_import_location() rtcl_import_category() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.
Product
Classified Listing – Classified ads & Business Directory
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WooCommerce Cloak Affiliate Links: Unauthorized modification of dataCVE-2024-1308 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate links.
Product
WooCommerce Cloak Affiliate Links
Affected
up to 1.0.33
What to do
Affects up to 1.0.33. Update WooCommerce Cloak Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Time-based SQL InjectionCVE-2024-0952 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with accounting manager or admin privileges or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Affected
up to 1.12.9
What to do
Affects up to 1.12.9. Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024The s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerablCVE-2024-0899 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 230815 via the API. This makes it possible for unauthenticated attackers to see the contents of those posts and pages.
Affected
up to 230815
What to do
Affects up to 230815. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Watu Quiz: Sensitive Information ExposureCVE-2024-0872 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-userinfo shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user meta data which can include session tokens and user emails.
Product
Watu Quiz
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024WooCommerce Clover Payment Gateway: Unauthorized modification of dataCVE-2024-0626 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Clover Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callback_handler function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to mark orders as paid.
Product
WooCommerce Clover Payment Gateway
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WooCommerce Clover Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-0588 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing nonce validation on the pmpro_lifter_save_streamline_option() function. This makes it possible for unauthenticated attackers to enable the streamline setting with Lifter LMS via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-32793 and CVE-2024-32794 appear to be a duplicate of this issue.
Product
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Affected
up to 2.12.10
What to do
Affects up to 2.12.10. Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score: Sensitive Information ExposureCVE-2023-7046 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated attackers to extract sensitive data including TLS Certificate Private Keys
Product
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score
Affected
up to 7.0
What to do
Affects up to 7.0. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024Pods – Custom Content Types and Fields: Remote Code ExxecutionCVE-2023-6999 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This makes it possible for authenticated attackers, with contributor level access or higher, to execute code on the server.
Product
Pods – Custom Content Types and Fields
Affected
up to 3.0.10
What to do
Affects up to 3.0.10. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Pods – Custom Content Types and Fields: SQL InjectionCVE-2023-6967 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to SQL Injection via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Pods – Custom Content Types and Fields
Affected
up to 3.0.10
What to do
Affects up to 3.0.10. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Pods – Custom Content Types and Fields: Missing AuthorizationCVE-2023-6965 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This is due to the fact that the plugin allows the use of a file inclusion feature via shortcode. This makes it possible for authenticated attackers, with contributor access or higher, to create pods and users (with default role).
Product
Pods – Custom Content Types and Fields
Affected
up to 3.0.10
What to do
Affects up to 3.0.10. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024WP Reset – Most Advanced WordPress Reset Tool: Sensitive Information ExposureCVE-2023-6799 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible for unauthenticated attackers to extract sensitive data including site backups by brute-forcing the snapshot filenames. Please note that the vendor does not plan to do any further hardening on this functionality.
Product
WP Reset – Most Advanced WordPress Reset Tool
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP Reset – Most Advanced WordPress Reset Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024Beaver Themer: Sensitive Information ExposureCVE-2023-6695 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Beaver Themer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the 'wpbb' shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including arbitrary user_meta values.
Product
Beaver Themer
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Beaver Themer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbeaverbuilder.com
Apr 9, 2024Invitation Code Content Restriction Plugin from CreativeMinds: Reflected Cross-Site ScriptingCVE-2022-4965 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Invitation Code Content Restriction Plugin from CreativeMinds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘target_id’ parameter in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Invitation Code Content Restriction Plugin from CreativeMinds
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Invitation Code Content Restriction Plugin from CreativeMinds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cminds.com wordfence.com
Apr 9, 2024AIKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31370 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeIsAwesome AIKit aikit-wordpress-ai-writing-assistant-using-gpt3.This issue affects AIKit: from n/a through <= 4.14.1.
Product
AIKit
Affected
up to 4.14.1
What to do
Affects up to 4.14.1. Update AIKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Soledad: Missing AuthorizationCVE-2024-31368 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
Product
Soledad
Affected
up to 8.4.2
What to do
Affects up to 8.4.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Soledad: Missing AuthorizationCVE-2024-31367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
Product
Soledad
Affected
up to 8.4.2
What to do
Affects up to 8.4.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Post Type Builder (PTB): Missing AuthorizationCVE-2024-31366 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8.
Product
Post Type Builder (PTB)
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Post Type Builder (PTB) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 9, 2024Post Type Builder (PTB): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31365 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Post Type Builder (PTB) allows Reflected XSS.This issue affects Post Type Builder (PTB): from n/a before 2.1.1.
Product
Post Type Builder (PTB)
Fixed in
2.1.1
What to do
Update Post Type Builder (PTB) to 2.1.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 8, 2024WP2LEADS: Missing AuthorizationCVE-2024-31375 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads.This issue affects WP2LEADS: from n/a through <= 3.2.7.
Product
WP2LEADS
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 8, 2024Ultimate Store Kit Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31357 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.5.2.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024MailMunch – Grow your Email List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailMunch – Grow your Email List allows Stored XSS.This issue affects MailMunch – Grow your Email List: from n/a through 3.1.6.
Product
MailMunch – Grow your Email List
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update MailMunch – Grow your Email List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials allows Stored XSS.This issue affects Testimonials: from n/a through 3.0.5.
Product
Testimonials
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Gradient Text Widget for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31346 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksmarket Gradient Text Widget for Elementor allows Stored XSS.This issue affects Gradient Text Widget for Elementor: from n/a through 1.0.1.
Product
Gradient Text Widget for Elementor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Gradient Text Widget for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Easy Login Styler – White Label Admin Login Page for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31344 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phpbits Creative Studio Easy Login Styler – White Label Admin Login Page for WordPress allows Stored XSS.This issue affects Easy Login Styler – White Label Admin Login Page for WordPress: from n/a through 1.0.6.
Product
Easy Login Styler – White Label Admin Login Page for
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Easy Login Styler – White Label Admin Login Page for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024WP Import Export Lite: Deserialization of Untrusted DataCVE-2024-31308 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.
Product
WP Import Export Lite
Affected
up to 3.9.26
What to do
Affects up to 3.9.26. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Essential Blocks for Gutenberg: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31306 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Stored XSS.This issue affects Essential Blocks for Gutenberg: from n/a through 4.5.3.
Product
Essential Blocks for Gutenberg
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024BookingPress: Authorization Bypass Through User-Controlled KeyCVE-2024-31296 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.
Product
BookingPress
Affected
up to 1.0.81
What to do
Affects up to 1.0.81. Update BookingPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024ProfileGrid: Authorization Bypass Through User-Controlled KeyCVE-2024-31291 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.
Product
ProfileGrid
Affected
up to 5.7.6
What to do
Affects up to 5.7.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Product Designer: Deserialization of Untrusted DataCVE-2024-31277 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32.
Product
Product Designer
Affected
up to 1.0.32
What to do
Affects up to 1.0.32. Update Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Edwiser Bridge: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31260 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WisdmLabs Edwiser Bridge.This issue affects Edwiser Bridge: from n/a through 3.0.2.
Product
Edwiser Bridge
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Form to Chat App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31258 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Micro.Company Form to Chat App allows Stored XSS.This issue affects Form to Chat App: from n/a through 1.1.6.
Product
Form to Chat App
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Form to Chat App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Formsite | Embed online forms to collect orders, registrations, leads, and surveys: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formsite Formsite | Embed online forms to collect orders, registrations, leads, and surveys allows Stored XSS.This issue affects Formsite | Embed online forms to collect orders, registrations, leads, and surveys: from n/a through 1.6.
Product
Formsite | Embed online forms to collect orders, registrations, leads, and surveys
Affected
up to 1.6
What to do
Affects up to 1.6. Update Formsite | Embed online forms to collect orders, registrations, leads, and surveys to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024WebinarPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31256 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebinarPress allows Reflected XSS.This issue affects WebinarPress: from n/a through 1.33.10.
Product
WebinarPress
Affected
up to 1.33.10
What to do
Affects up to 1.33.10. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024ELEX WooCommerce Dynamic Pricing and Discounts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31255 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts allows Reflected XSS.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2.
Product
ELEX WooCommerce Dynamic Pricing and Discounts
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update ELEX WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024LearnPress Export Import: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31241 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress LearnPress Export Import.This issue affects LearnPress Export Import: from n/a through 4.0.3.
Product
LearnPress Export Import
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update LearnPress Export Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31236 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.3.93.
Product
Royal Elementor Addons
Affected
up to 1.3.93
What to do
Affects up to 1.3.93. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2024REHub Framework: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-31234 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam REHub Framework.This issue affects REHub Framework: from n/a before 19.6.2.
Product
REHub Framework
Fixed in
19.6.2
What to do
Update REHub Framework to 19.6.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.