Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

428new WordPress flaws this week

399,168entries in the database

24,763 results · page 409 of 496

Mar 26, 2024The Plus Addons for Elementor: Local File InclusionCVE-2024-2203 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
The Plus Addons for Elementor
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update The Plus Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2024Quiz And Survey Master: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28787 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.4.
Product
Quiz And Survey Master
Affected
up to 8.1.4
What to do
Affects up to 8.1.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Glaze Blog Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-28687 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perfectwpthemes Glaze Blog Lite, themebeez Fascinate, themebeez Cream Blog, themebeez Cream Magazine allows Reflected XSS.This issue affects Glaze Blog Lite: from n/a through <= 1.1.4; Fascinate: from n/a through 1.0.8; Cream Blog: from n/a through 2.1.3; Cream Magazine: from n/a through 2.1.4.
Product
Glaze Blog Lite
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Glaze Blog Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Community by PeepSo: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-27630 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.0.9.0.
Product
Community by PeepSo
Affected
up to 6.0.9.0
What to do
Affects up to 6.0.9.0. Update Community by PeepSo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024User Registration: Deserialization of Untrusted DataCVE-2023-27459 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1.
Product
User Registration
Affected
up to 2.3.2.1
What to do
Affects up to 2.3.2.1. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Upload Resume: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-25965 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in mbbhatti Upload Resume.This issue affects Upload Resume: from n/a through 1.2.0.
Product
Upload Resume
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Upload Resume to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024MainWP File Uploader Extension: Unrestricted Upload of File with Dangerous TypeCVE-2023-23656 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from n/a through 4.1.
Product
MainWP File Uploader Extension
Affected
up to 4.1
What to do
Affects up to 4.1. Update MainWP File Uploader Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024RegistrationMagic: Cross-Site Request Forgery (CSRF)CVE-2024-2951 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.3.0.0.
Product
RegistrationMagic
Affected
up to 5.3.0.0
What to do
Affects up to 5.3.0.0. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024CF7 Google Sheets Connector: Insertion of Sensitive Information into Log FileCVE-2023-44989 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information into Log File vulnerability in GSheetConnector CF7 Google Sheets Connector.This issue affects CF7 Google Sheets Connector: from n/a through 5.0.5.
Product
CF7 Google Sheets Connector
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update CF7 Google Sheets Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which CVE-2024-29833 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29832 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 6.1
The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29810 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29809 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29808 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4
The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Fixed in
1.8.22
What to do
Update the plugin to 1.8.22 or newer.
Full record and what to do →NVD record appcheck-ng.com wordpress.org
Mar 26, 2024Multiple Page Generator Plugin – MPG: Missing AuthorizationCVE-2024-30235 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WholesaleX: Missing AuthorizationCVE-2024-30234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1.
Product
WholesaleX
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WholesaleX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WholesaleX: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-30233 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1.
Product
WholesaleX
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WholesaleX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Radio Player: Missing AuthorizationCVE-2024-2906 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
Product
Radio Player
Affected
up to 2.0.73
What to do
Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024SalesKing: Missing AuthorizationCVE-2024-22156 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15.
Product
SalesKing
Affected
up to 1.6.15
What to do
Affects up to 1.6.15. Update SalesKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Void Contact Form 7 Widget For Elementor Page Builder: Missing AuthorizationCVE-2023-52214 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.
Product
Void Contact Form 7 Widget For Elementor Page Builder
Affected
up to 2.3
What to do
Affects up to 2.3. Update Void Contact Form 7 Widget For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Exclusive Addons Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30232 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exclusive Addons Exclusive Addons Elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through 2.6.9.
Product
Exclusive Addons Elementor
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update Exclusive Addons Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WooCommerce Box Office: Missing AuthorizationCVE-2024-24799 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WooCommerce WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.2.2.
Product
WooCommerce Box Office
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update WooCommerce Box Office to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Location Picker at Checkout for WooCommerce: Missing AuthorizationCVE-2024-24719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Uriahs Victor Location Picker at Checkout for WooCommerce.This issue affects Location Picker at Checkout for WooCommerce: from n/a through 1.8.9.
Product
Location Picker at Checkout for WooCommerce
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update Location Picker at Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024PropertyHive: Missing AuthorizationCVE-2024-24718 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.6.
Product
PropertyHive
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WooCommerce Conversion Tracking: Missing AuthorizationCVE-2024-24711 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.
Product
WooCommerce Conversion Tracking
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update WooCommerce Conversion Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024PopupAlly: Missing AuthorizationCVE-2024-23520 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AccessAlly PopupAlly.This issue affects PopupAlly: from n/a through 2.1.0.
Product
PopupAlly
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update PopupAlly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WP Dummy Content Generator: Missing AuthorizationCVE-2024-24805 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 3.1.2.
Product
WP Dummy Content Generator
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024User Submitted Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-7251 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS.This issue affects User Submitted Posts: from n/a through 20230901.
Product
User Submitted Posts
Affected
up to 20230901
What to do
Affects up to 20230901. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Contact Form With Captcha: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-45771 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Contact Form With Captcha allows Reflected XSS.This issue affects Contact Form With Captcha: from n/a through 1.6.8.
Product
Contact Form With Captcha
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Contact Form With Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Front End Users: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-33322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Etoile Web Design Front End Users allows Reflected XSS.This issue affects Front End Users: from n/a before 3.2.25.
Product
Front End Users
Fixed in
3.2.25
What to do
Update Front End Users to 3.2.25 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024TheGem (Elementor): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-32237 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery) allows Stored XSS.This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1.
Product
TheGem (Elementor)
Fixed in
5.8.1.1
What to do
Update TheGem (Elementor) to 5.8.1.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-23991 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdevelop / Oplugins Booking Calendar allows SQL Injection.This issue affects Booking Calendar: from n/a through 9.4.3.
Product
Booking Calendar
Affected
up to 9.4.3
What to do
Affects up to 9.4.3. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Cosmetsy theme (core plugin): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49839 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo theme (core plugin), KlbTheme Bacola theme (core plugin), KlbTheme Medibazar theme (core plugin), KlbTheme Furnob theme (core plugin), KlbTheme Clotya theme (core plugin) allows Reflected XSS.This issue affects Cosmetsy theme (core plugin): from n/a through 1.3.0; Partdo theme (core plugin): from n/a through 1.0.9; Bacola theme (core plugin): from n/a through 1.3.3; Medibazar theme (core plugin): from n/a through 1.2.3; Furnob theme (core plugin): from n/a through 1.1.7; Clotya theme (core plugin): from n/a through 1.1.5.
Product
Cosmetsy theme (core plugin)
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Cosmetsy theme (core plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024WP-Lister Lite for Amazon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-2889 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.This issue affects WP-Lister Lite for Amazon: from n/a through <= 2.6.11.
Product
WP-Lister Lite for Amazon
Affected
up to 2.6.11
What to do
Affects up to 2.6.11. Update WP-Lister Lite for Amazon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-2888 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor allows Stored XSS.This issue affects Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: from n/a through 1.26.2.
Product
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
Affected
up to 1.26.2
What to do
Affects up to 1.26.2. Update Post and Page Builder by BoldGrid – Visual Drag and Drop Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024VK All in One Expansion Unit: Stored Cross-Site ScriptingCVE-2024-2170 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and including, 9.96.0.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className.' This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
VK All in One Expansion Unit
Affected
up to 9.96.0.1
What to do
Affects up to 9.96.0.1. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 26, 2024Backup and Restore WordPress: Does not protect some log files containing sensitive information suchCVE-2023-7232 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as site configuration etc, allowing unauthenticated users to access such data
Product
Backup and Restore WordPress
Affected
up to 1.45
What to do
Affects up to 1.45. Update Backup and Restore WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2024Check & Log Email: Unauthenticated Hook InjectionCVE-2024-0866 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
Product
Check & Log Email
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Check & Log Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 25, 2024Points and Rewards for WooCommerce: Missing AuthorizationCVE-2023-27608 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.
Product
Points and Rewards for WooCommerce
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Points and Rewards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Google Maps CP: Missing AuthorizationCVE-2023-25039 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Google Maps CP.This issue affects Google Maps CP: from n/a through 1.0.43.
Product
Google Maps CP
Affected
up to 1.0.43
What to do
Affects up to 1.0.43. Update Google Maps CP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024MainWP Wordfence Extension: Missing AuthorizationCVE-2023-22699 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MainWP MainWP Wordfence Extension.This issue affects MainWP Wordfence Extension: from n/a through 4.0.7.
Product
MainWP Wordfence Extension
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update MainWP Wordfence Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024ShareThis Dashboard for Google Analytics: Missing AuthorizationCVE-2022-45851 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShareThis ShareThis Dashboard for Google Analytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a through 3.1.4.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45352 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45351 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Betheme: Missing AuthorizationCVE-2022-45349 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.
Product
Betheme
Affected
up to 26.6.1
What to do
Affects up to 26.6.1. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024SEO Plugin by Squirrly SEO: Missing AuthorizationCVE-2022-44626 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.1.20
What to do
Affects up to 12.1.20. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Advance WordPress Search: Missing AuthorizationCVE-2022-38057 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.
Product
Advance WordPress Search
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Advance WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024Youzify - Buddypress Moderation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-2864 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify - Buddypress Moderation.This issue affects Youzify - Buddypress Moderation: from n/a through 1.2.5.
Product
Youzify - Buddypress Moderation
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Youzify - Buddypress Moderation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2024easy-popup-show all versions: Cross-site request forgery (CSRF)CVE-2024-29009 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site request forgery (CSRF) vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the authentication of the administrator and to perform unintended operations if the administrator views a malicious page while logged in.
Product
easy-popup-show all versions
What to do
Update easy-popup-show all versions to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.