Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

24,763 results · page 422 of 496

Jan 5, 2024WooCommerce Stripe Payment Gateway: Authorization Bypass Through User-Controlled KeyCVE-2023-51502 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.
Product
WooCommerce Stripe Payment Gateway
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update WooCommerce Stripe Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 3, 2024WP-Members Membership: Sensitive Information ExposureCVE-2023-6733 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more.
Product
WP-Members Membership
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 3, 2024Product Expiry for WooCommerce: Unauthorized modification of dataCVE-2024-0201 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings. CVE-2023-52179 appears to be a duplicate of this issue.
Product
Product Expiry for WooCommerce
Affected
up to 2.5
What to do
Affects up to 2.5. Update Product Expiry for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2024PowerPack Addons for Elementor (Free Widgets, Extensions and Templates): Cross-Site Request ForgeryCVE-2023-6984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.13. This is due to missing or incorrect nonce validation in the powerpack-lite-for-elementor/classes/class-pp-admin-settings.php file. This makes it possible for unauthenticated attackers to modify and reset plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
Affected
up to 2.7.13
What to do
Affects up to 2.7.13. Update PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 3, 2024WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: SQL InjectionCVE-2023-6981 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id' parameter in all versions up to, and including, 6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can leveraged to achieve Reflected Cross-site Scripting.
Product
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
Affected
up to 6.5
What to do
Affects up to 6.5. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 3, 2024WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: Cross-Site Request ForgeryCVE-2023-6980 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5. This is due to missing or incorrect nonce validation on the 'delete' action of the wp-sms-subscribers page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
Affected
up to 6.5
What to do
Affects up to 6.5. Update WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 3, 2024OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: Unauthorized modification of data and Stored Cross-Site ScriptingCVE-2023-6600 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease note there were several attempted patched, and we consider 5.7.10 to be the most sufficiently patched.
Product
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Affected
up to 5.7.9
What to do
Affects up to 5.7.9. Update OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Stored Cross-Site ScriptingCVE-2023-7027 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2024POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for: Reflected Cross-Site ScriptingCVE-2023-6629 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-6621 appears to be a duplicate of this issue. CVE-2024-29128 appears to be a duplicate of this issue.
Product
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 1, 2024Backup Migration: Stores in-progress backups information in easy to findCVE-2023-6271 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups.
Product
Backup Migration
Fixed in
1.3.6
What to do
Update Backup Migration to 1.3.6 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Jan 1, 2024The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key informationCVE-2023-6113 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowing unauthenticated attackers to download said backups later.
Product
WP STAGING WordPress Backup
Fixed in
3.1.3
What to do
Update WP STAGING WordPress Backup to 3.1.3 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Jan 1, 2024PayHere Payment Gateway: Automatically creates publicly-accessible log files containing sensitive informationCVE-2023-6064 · WordPress plugins & themes · reported by WPScanHigh 7.5
The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur.
Product
PayHere Payment Gateway
Fixed in
2.2.12
What to do
Update PayHere Payment Gateway to 2.2.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 1, 2024affiliate-toolkit: Lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiverCVE-2023-5877 · WordPress plugins & themes · reported by WPScanCritical 9.8
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.
Product
affiliate-toolkit
Fixed in
3.4.3
What to do
Update affiliate-toolkit to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 31, 2023Most And Least Read Posts Widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52133 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.16.
Product
Most And Least Read Posts Widget
Affected
up to 2.5.16
What to do
Affects up to 2.5.16. Update Most And Least Read Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023WP Adminify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52132 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.
Product
WP Adminify
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Page Generator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52131 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Zinc Page Generator.This issue affects Page Generator: from n/a through 1.7.1.
Product
Page Generator
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Page Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Fluent Support – WordPress Helpdesk and Customer Support Ticket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51547 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin: from n/a through 1.7.6.
Product
Fluent Support – WordPress Helpdesk and Customer Support Ticket
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Fluent Support – WordPress Helpdesk and Customer Support Ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023WooPayments – Fully Integrated Solution Built and Supported by Woo: Authorization Bypass Through User-Controlled KeyCVE-2023-51503 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.
Product
WooPayments – Fully Integrated Solution Built and Supported by Woo
Affected
up to 6.9.2
What to do
Affects up to 6.9.2. Update WooPayments – Fully Integrated Solution Built and Supported by Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Checkout Mestres WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51469 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestres do WP Checkout Mestres WP.This issue affects Checkout Mestres WP: from n/a through 7.1.9.6.
Product
Checkout Mestres WP
Affected
up to 7.1.9.6
What to do
Affects up to 7.1.9.6. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51423 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
Product
Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Affected
up to 3.05.0
What to do
Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52185 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin.This issue affects Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin: from n/a through 2.1.9.
Product
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023GEO my: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52134 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This issue affects GEO my WordPress: from n/a through 4.0.2.
Product
GEO my
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update GEO my to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Recipe Maker For Your Food Blog from Zip Recipes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52180 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes.This issue affects Recipe Maker For Your Food Blog from Zip Recipes: from n/a through 8.1.0.
Product
Recipe Maker For Your Food Blog from Zip Recipes
Affected
up to 8.1.0
What to do
Affects up to 8.1.0. Update Recipe Maker For Your Food Blog from Zip Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023YITH WooCommerce Product Add-Ons: Deserialization of Untrusted DataCVE-2023-49777 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023ARI Stream Quiz – WordPress Quizzes Builder: Deserialization of Untrusted DataCVE-2023-52182 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes Builder: from n/a through 1.3.0.
Product
ARI Stream Quiz – WordPress Quizzes Builder
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update ARI Stream Quiz – WordPress Quizzes Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Theme per user: Deserialization of Untrusted DataCVE-2023-52181 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1.
Product
Theme per user
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Theme per user to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023JetElements For Elementor: Improper Control of Generation of Code ('Code Injection')CVE-2023-39157 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.
Product
JetElements For Elementor
Affected
up to 2.6.10
What to do
Affects up to 2.6.10. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023eCommerce Product Catalog Plugin for: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51688 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress.This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26.
Product
eCommerce Product Catalog Plugin for
Affected
up to 3.3.26
What to do
Affects up to 3.3.26. Update eCommerce Product Catalog Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Product Catalog Simple: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51687 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.This issue affects Product Catalog Simple: from n/a through 1.7.6.
Product
Product Catalog Simple
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023AI Power: Complete AI Pack – Powered by GPT-4: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51527 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.2.
Product
AI Power: Complete AI Pack – Powered by GPT-4
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update AI Power: Complete AI Pack – Powered by GPT-4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Calculated Fields Form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51517 · WordPress plugins & themes · reported by PatchstackMedium 4.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a through 1.2.28.
Product
Calculated Fields Form
Affected
up to 1.2.28
What to do
Affects up to 1.2.28. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51675 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.18
What to do
Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Job Manager & Career – Manage job board listings, and recruitments: Cross-Site Request Forgery (CSRF), Deserialization of Untrusted DataCVE-2023-51545 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.
Product
Job Manager & Career – Manage job board listings, and recruitments
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Job Manager & Career – Manage job board listings, and recruitments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Deserialization of Untrusted DataCVE-2023-51505 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Rencontre – Dating Site: Deserialization of Untrusted DataCVE-2023-51470 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11.1.
Product
Rencontre – Dating Site
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Rencontre – Dating Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Deserialization of Untrusted DataCVE-2023-51422 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
Product
Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Affected
up to 3.05.0
What to do
Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023EnvíaloSimple: Email Marketing y Newsletters: Deserialization of Untrusted DataCVE-2023-51414 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.
Product
EnvíaloSimple: Email Marketing y Newsletters
Affected
up to 2.1
What to do
Affects up to 2.1. Update EnvíaloSimple: Email Marketing y Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Impreza – WordPress Website and WooCommerce Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50893 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution Impreza – WordPress Website and WooCommerce Builder allows Reflected XSS.This issue affects Impreza – WordPress Website and WooCommerce Builder: from n/a through 8.17.4.
Product
Impreza – WordPress Website and WooCommerce Builder
Affected
up to 8.17.4
What to do
Affects up to 8.17.4. Update Impreza – WordPress Website and WooCommerce Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023TheGem - Creative Multi-Purpose & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50892 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9.1.
Product
TheGem - Creative Multi-Purpose & WooCommerce
Affected
up to 5.9.1
What to do
Affects up to 5.9.1. Update TheGem - Creative Multi-Purpose & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Form plugin for WordPress – Zoho Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50891 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Form plugin for WordPress – Zoho Forms allows Stored XSS.This issue affects Form plugin for WordPress – Zoho Forms: from n/a through 3.0.1.
Product
Form plugin for WordPress – Zoho Forms
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Form plugin for WordPress – Zoho Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Beaver Builder – WordPress Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50889 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder – WordPress Page Builder allows Stored XSS.This issue affects Beaver Builder – WordPress Page Builder: from n/a through 2.7.2.
Product
Beaver Builder – WordPress Page Builder
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Beaver Builder – WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.
Product
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
Affected
up to 6.9.15
What to do
Affects up to 6.9.15. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023BuddyPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50880 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Community BuddyPress allows Stored XSS.This issue affects BuddyPress: from n/a through 11.3.1.
Product
BuddyPress
Affected
up to 11.3.1
What to do
Affects up to 11.3.1. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023WordPress.Com Editing Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50879 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS.This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784.
Product
WordPress.Com Editing Toolkit
Affected
up to 3.78784
What to do
Affects up to 3.78784. Update WordPress.Com Editing Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Login Lockdown – Protect Login Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50837 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form.This issue affects Login Lockdown – Protect Login Form: from n/a through 2.06.
Product
Login Lockdown – Protect Login Form
Affected
up to 2.06
What to do
Affects up to 2.06. Update Login Lockdown – Protect Login Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023WS Form LITE – Drag & Drop Contact Form Builder for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52135 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress.This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170.
Product
WS Form LITE – Drag & Drop Contact Form Builder for
Affected
up to 1.9.170
What to do
Affects up to 1.9.170. Update WS Form LITE – Drag & Drop Contact Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Stock Ticker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Stock Ticker allows Stored XSS.This issue affects Stock Ticker: from n/a through 3.23.4.
Product
Stock Ticker
Affected
up to 3.23.4
What to do
Affects up to 3.23.4. Update Stock Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Back Button Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51399 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget allows Stored XSS.This issue affects Back Button Widget: from n/a through 1.6.3.
Product
Back Button Widget
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Back Button Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023WP Remote Site Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51397 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force WP Remote Site Search allows Stored XSS.This issue affects WP Remote Site Search: from n/a through 1.0.4.
Product
WP Remote Site Search
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update WP Remote Site Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Brizy – Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51396 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy.Io Brizy – Page Builder allows Stored XSS.This issue affects Brizy – Page Builder: from n/a through 2.4.29.
Product
Brizy – Page Builder
Affected
up to 2.4.29
What to do
Affects up to 2.4.29. Update Brizy – Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.