Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,763 results · page 426 of 496
Dec 19, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Deserialization of Untrusted DataCVE-2023-34382 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.
- Product
- Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
- Affected
- up to 3.7.19
- What to do
- Affects up to 3.7.19. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Recently Viewed Products: Deserialization of Untrusted DataCVE-2023-34027 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0.
- Product
- Recently Viewed Products
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Recently Viewed Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Media File Renamer: Rename Files (Manual, Auto & AI): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects Media File Renamer: Rename Files (Manual, Auto & AI): from n/a through 5.6.9.
- Product
- Media File Renamer: Rename Files (Manual, Auto & AI)
- Affected
- up to 5.6.9
- What to do
- Affects up to 5.6.9. Update Media File Renamer: Rename Files (Manual, Auto & AI) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Aruba HiSpeed Cache: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44983 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.6.
- Product
- Aruba HiSpeed Cache
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Aruba HiSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Themesflat Addons For Elementor: Deserialization of Untrusted DataCVE-2023-37390 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.
- Product
- Themesflat Addons For Elementor
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in: Missing AuthorizationCVE-2023-25715 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress: from n/a through 2.5.6.
- Product
- GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2023Simple Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.This issue affects Simple Membership: from n/a through 4.3.8.
- Product
- Simple Membership
- Affected
- up to 4.3.8
- What to do
- Affects up to 4.3.8. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44982 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.
- Product
- Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)
- Affected
- up to 6.4.5
- What to do
- Affects up to 6.4.5. Update Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Structured Content (JSON-LD) #wpsc: Deserialization of Untrusted DataCVE-2023-49819 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.
- Product
- Structured Content (JSON-LD) #wpsc
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Structured Content (JSON-LD) #wpsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Participants Database: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-48751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5.
- Product
- Participants Database
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Delete Duplicate Posts: Missing AuthorizationCVE-2023-47754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Clever plugins Delete Duplicate Posts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Delete Duplicate Posts: from n/a through 4.8.9.
- Product
- Delete Duplicate Posts
- Affected
- up to 4.8.9
- What to do
- Affects up to 4.8.9. Update Delete Duplicate Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WP EXtra: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-46212 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a through 6.2.
- Product
- WP EXtra
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update WP EXtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023E2Pdf – Export To Pdf Tool for: Deserialization of Untrusted DataCVE-2023-46154 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18.
- Product
- E2Pdf – Export To Pdf Tool for
- Affected
- up to 1.20.18
- What to do
- Affects up to 1.20.18. Update E2Pdf – Export To Pdf Tool for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Thumbs Rating: Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2022-45809 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.0.0.
- Product
- Thumbs Rating
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Thumbs Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Who Hit The Page – Hit Counter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47558 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mahlamusa Who Hit The Page – Hit Counter allows SQL Injection.This issue affects Who Hit The Page – Hit Counter: from n/a through 1.4.14.3.
- Product
- Who Hit The Page – Hit Counter
- Affected
- up to 1.4.14.3
- What to do
- Affects up to 1.4.14.3. Update Who Hit The Page – Hit Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Redirect 404 Error Page to Homepage or Custom Page with Logs: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47530 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7.
- Product
- Redirect 404 Error Page to Homepage or Custom Page with Logs
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update Redirect 404 Error Page to Homepage or Custom Page with Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Master Slider Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-47506 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Master slider Master Slider Pro allows SQL Injection.This issue affects Master Slider Pro: from n/a through 3.6.5.
- Product
- Master Slider Pro
- Affected
- up to 3.6.5
- What to do
- Affects up to 3.6.5. Update Master Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023WP Report Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-34168 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Raven WP Report Post allows SQL Injection.This issue affects WP Report Post: from n/a through 2.1.2.
- Product
- WP Report Post
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update WP Report Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Product Vendors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33331 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.
- Product
- Product Vendors
- Affected
- up to 2.1.76
- What to do
- Affects up to 2.1.76. Update Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023MkRapel Regiones y Ciudades de Chile para WC: Cross-Site Request Forgery (CSRF)CVE-2023-48781 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades de Chile para WC: from n/a through 4.3.0.
- Product
- MkRapel Regiones y Ciudades de Chile para WC
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update MkRapel Regiones y Ciudades de Chile para WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023Prevent Landscape Rotation: Cross-Site Request Forgery (CSRF)CVE-2023-48772 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0.
- Product
- Prevent Landscape Rotation
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Prevent Landscape Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023SiteOrigin Widgets Bundle: Does not validate user input before using it to generate paths passed to include function/sCVE-2023-6295 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
- Product
- SiteOrigin Widgets Bundle
- Fixed in
- 1.51.0
- What to do
- Update SiteOrigin Widgets Bundle to 1.51.0 or newer.
Dec 18, 2023Theme My Login 2FA: Does not rate limit 2FA validation attemptsCVE-2023-6272 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.
- Product
- Theme My Login 2FA
- Fixed in
- 1.2
- What to do
- Update Theme My Login 2FA to 1.2 or newer.
Dec 18, 2023Slider: Does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the requestCVE-2023-6077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
- Product
- Slider
- Fixed in
- 3.5.12
- What to do
- Update Slider to 3.5.12 or newer.
Dec 18, 2023Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro: Does not sanitise and escape some of its settingsCVE-2023-5005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro
- Fixed in
- 3.0
- What to do
- Update Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro to 3.0 or newer.
Dec 18, 2023GiveWP – Donation Plugin and Fundraising Platform: Server-Side Request Forgery (SSRF)CVE-2022-40312 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 2.25.1
- What to do
- Affects up to 2.25.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 17, 2023FOX – Currency Switcher Professional for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2023-49834 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 FOX – Currency Switcher Professional for WooCommerce.This issue affects FOX – Currency Switcher Professional for WooCommerce: from n/a through 1.4.1.4.
- Product
- FOX – Currency Switcher Professional for WooCommerce
- Affected
- up to 1.4.1.4
- What to do
- Affects up to 1.4.1.4. Update FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 16, 2023MW WP Form: Arbitrary file deletionCVE-2023-6559 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
- Product
- MW WP Form
- Affected
- up to 5.0.3
- What to do
- Affects up to 5.0.3. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 15, 2023Tutor LMS – eLearning and online course solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49829 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS – eLearning and online course solution allows Stored XSS.This issue affects Tutor LMS – eLearning and online course solution: from n/a through 2.2.4.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49823 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 4.6.1.
- Product
- Bold Page Builder
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49767 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Stored XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24.
- Product
- Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
- Affected
- up to 2.2.24
- What to do
- Affects up to 2.2.24. Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Guest Author: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49747 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebFactory Ltd Guest Author allows Stored XSS.This issue affects Guest Author: from n/a through 2.3.
- Product
- Guest Author
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Guest Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023GDPR Cookie Consent by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49191 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic GDPR Cookie Consent by Supsystic allows Stored XSS.This issue affects GDPR Cookie Consent by Supsystic: from n/a through 2.1.2.
- Product
- GDPR Cookie Consent by Supsystic
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update GDPR Cookie Consent by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Site Offline Or Coming Soon Or Maintenance Mode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49190 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandra Shekhar Sahu Site Offline Or Coming Soon Or Maintenance Mode allows Stored XSS.This issue affects Site Offline Or Coming Soon Or Maintenance Mode: from n/a through 1.5.6.
- Product
- Site Offline Or Coming Soon Or Maintenance Mode
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Site Offline Or Coming Soon Or Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Social Share Buttons & Analytics Plugin – GetSocial.Io: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49189 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Getsocial, S.A. Social Share Buttons & Analytics Plugin – GetSocial.Io allows Stored XSS.This issue affects Social Share Buttons & Analytics Plugin – GetSocial.Io: from n/a through 4.3.12.
- Product
- Social Share Buttons & Analytics Plugin – GetSocial.Io
- Affected
- up to 4.3.12
- What to do
- Affects up to 4.3.12. Update Social Share Buttons & Analytics Plugin – GetSocial.Io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Track Geolocation Of Users Using Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49188 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.This issue affects Track Geolocation Of Users Using Contact Form 7: from n/a through 2.0.
- Product
- Track Geolocation Of Users Using Contact Form 7
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Track Geolocation Of Users Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Adifier - Classified Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49187 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
- Product
- Adifier - Classified Ads
- Fixed in
- 3.1.4
- What to do
- Update Adifier - Classified Ads to 3.1.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Doofinder WP & WooCommerce Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49185 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Doofinder Doofinder WP & WooCommerce Search allows Reflected XSS.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.1.7.
- Product
- Doofinder WP & WooCommerce Search
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update Doofinder WP & WooCommerce Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Parallax Slider Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49184 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Parallax Slider Block allows Stored XSS.This issue affects Parallax Slider Block: from n/a through 1.2.4.
- Product
- Parallax Slider Block
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Parallax Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023NextScripts: Social Networks Auto-Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49183 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts: Social Networks Auto-Poster allows Reflected XSS.This issue affects NextScripts: Social Networks Auto-Poster: from n/a through 4.4.2.
- Product
- NextScripts: Social Networks Auto-Poster
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update NextScripts: Social Networks Auto-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023List all posts by Authors, nested Categories and Titles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49182 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Marzocca List all posts by Authors, nested Categories and Titles allows Reflected XSS.This issue affects List all posts by Authors, nested Categories and Titles: from n/a through 2.7.10.
- Product
- List all posts by Authors, nested Categories and Titles
- Affected
- up to 2.7.10
- What to do
- Affects up to 2.7.10. Update List all posts by Authors, nested Categories and Titles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49181 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce allows Stored XSS.This issue affects WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: from n/a through 3.1.40.
- Product
- WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
- Affected
- up to 3.1.40
- What to do
- Affects up to 3.1.40. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Automatic Youtube Video Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49180 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ternstyle LLC Automatic Youtube Video Posts Plugin allows Stored XSS.This issue affects Automatic Youtube Video Posts Plugin: from n/a through 5.2.2.
- Product
- Automatic Youtube Video Posts
- Affected
- up to 5.2.2
- What to do
- Affects up to 5.2.2. Update Automatic Youtube Video Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49179 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored XSS.This issue affects Event post: from n/a through 5.8.6.
- Product
- Event post
- Affected
- up to 5.8.6
- What to do
- Affects up to 5.8.6. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023HDW Player Plugin (Video Player & Video Gallery): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49178 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr. Hdwplayer HDW Player Plugin (Video Player & Video Gallery) allows Reflected XSS.This issue affects HDW Player Plugin (Video Player & Video Gallery): from n/a through 5.0.
- Product
- HDW Player Plugin (Video Player & Video Gallery)
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update HDW Player Plugin (Video Player & Video Gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023which template file: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49177 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gilles Dumas which template file allows Reflected XSS.This issue affects which template file: from n/a through 4.9.0.
- Product
- which template file
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update which template file to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023WP Pocket URLs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49176 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution WP Pocket URLs allows Reflected XSS.This issue affects WP Pocket URLs: from n/a through 1.0.2.
- Product
- WP Pocket URLs
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Pocket URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023KP Fastest Tawk.To Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49175 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreativo Pro KP Fastest Tawk.To Chat allows Stored XSS.This issue affects KP Fastest Tawk.To Chat: from n/a through 1.1.1.
- Product
- KP Fastest Tawk.To Chat
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update KP Fastest Tawk.To Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Responsive Lightbox & Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49174 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox & Gallery allows Stored XSS.This issue affects Responsive Lightbox & Gallery: from n/a through 2.4.5.
- Product
- Responsive Lightbox & Gallery
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Responsive Lightbox & Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Forms by CaptainForm – Form Builder for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captainform Forms by CaptainForm – Form Builder for WordPress allows Reflected XSS.This issue affects Forms by CaptainForm – Form Builder for WordPress: from n/a through 2.5.3.
- Product
- Forms by CaptainForm – Form Builder for
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Forms by CaptainForm – Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.